Nick Bradbury

Kudos to Microsoft

I'll echo Sam Ruby's comments:

"When the IE team screws up, it makes front page news everywhere. If life were fair, items like this one would get equal coverage."

Microsoft takes a lot of crap about security, but they deserve credit for putting security first in IE7's RSS implementation. I also want to thank Microsoft's Sean Lyndersay for reaching out to aggregator developers to help make our products more secure.

And while I'm at it, I'll also give credit to Microsoft for figuring out why Marc Orchant kept having trouble with FeedDemon and IE7. I was involved in a lengthy email thread between Marc and members of Microsoft's IE team, and it was impressive to witness Microsoft's debugging efforts. (BTW, it turned out that the problem was caused by having an older version of Google Desktop installed.)

High Score

So, who has the best score in the FeedDemon Easter egg?

Feed Security and FeedDemon, Part III

Last month I promised to talk about the exploits that James Snell uncovered which left feed readers vulnerable to some very annoying script-based attacks. I didn't want to provide details of the exploits until other feed readers had patched them, but now that James has published his test suites, I figure it's time to open the kimono. But before I go any further, I should first make two things clear:

1. Every one of the vulnerabilities was fixed in FeedDemon 2.0.0.25.
2. FeedDemon's newspapers operate in the Internet Zone rather than the local zone, so any script that makes it into a feed would not be able to access your local machine (ie: your data).

Now that that's out of the way, some details...

Like most feed readers, FeedDemon has always stripped potentially unsafe content from feeds, but James found several ways to get around this and was able to trick FeedDemon (and other feed readers) into displaying popups, toggling read status, and performing other annoying actions. The big "gotchas" that bit me were:

• I failed to handle whitespace in the word "javascript:" when used inside HTML attributes. Ex: javas cript:window.alert('gotcha')
• I failed to handle HTML entities that aren't separated with semi-colons. Ex: &#106&#x61&#118&#x61&#115c
• I failed to cleanse the xml:base attribute in Atom feeds. Ex: xml:base="javascript:window.alert('gotcha')"

At first glance it may seem that people would simply unsubscribe from any feed that contains an annoying exploit, but the risk goes beyond that. For example, an attacker could hijack a popular site (yes, it is possible) and inject malicious script into that site's feed. That way everyone subscribed to that feed would be exposed to the attack (ruining the site's reputation in the process).

The current crop of feed readers (including FeedDemon) protect from this with ultra-aggressive parsing and cleansing of feed content, but that's a never-ending battle. People will always find holes and exploit them, forcing aggregator developers to put out a steady stream of patches. I don't think any aggregator developer looks forward to that future, so let's come up with a better solution.

The real problem for desktop feed readers is that most of them can't simply disable script since they rely on JavaScript to interact with the browser (for example, FeedDemon's newspapers use JavaScript to change an item's appearance, among other things). However, it is possible to access the DOM through your application code directly, which means there is a way to block all script-based attacks without limiting the feed reader from interacting with the browser.

So, if you're developing a Windows-based feed reader which uses Internet Explorer's WebBrowser object, here's what I recommend:

• Enable the local zone lockdown feature to prevent script from accessing the local machine.
• Use the DLCTL_NO_SCRIPTS flag to completely disable scripting when viewing a page generated from your application. You can intercept the BeforeNavigate2 event to re-enable scripting before navigating to an external page.
• Access the DOM through application code via the various IHTMLDocument interfaces rather than through JavaScript (since script will no longer work after taking the previous step).

I've talked with a couple of aggregator developers about this approach, and they agree that it should work (and testing here shows that it does). You can expect FeedDemon to follow this approach soon.

As an aside, it may seem odd that I'd help my competitors by sharing this information, but I figure security flaws are an industry-wide problem, and not something that each developer should tackle alone. If we're going to prevent RSS from becoming as annoying as email, we need to work together on this.

Happy Anniversary?

One year ago today I underwent surgery which resulted in completely losing the hearing in my left ear. I never realized how important having two working ears was until this year. My hearing problems now cause me to miss out on conversations that happen amidst a lot of background noise, and music now sounds flat to me. I admit it, this has got me down over the past year.

But...

In the past year I've also recuperated, done what I believe is my best work so far, took a great vacation, saved my son's life and generally had a good time. So all in all, I figure it's still been a pretty good year.

I Missed my Calling

Yesterday I was talking with Brent Simmons and Brian Kellner about feed security, and how you really have to think like a hacker to find vulnerabilities in your software. That reminded me of my own brief experience as a software cracker, which I told them about.

See, back in early 1990s I had a short consulting stint with a large financial institution, working on the desktop piece of a client-server application that transferred millions of dollars over the wire. I was concerned that our login dialog might be vulnerable to password-sniffing, and when I raised this issue with my Program Manager, he tasked me with thinking of ways this could be accomplished. So I made it my calling to figure out how to get the PM's username and password in a way that wouldn't require physical access to his computer.

Much to my surprise, it took very little time. Here's what I did:

I wrote a small program in Visual Basic which sat in the background waiting for a window with the same title as our login dialog to appear (this was back in the Windows 3.1 days, when it was simple to do things like that). After the login dialog was detected, I'd start monitoring the keyboard and record any keystrokes that were entered into the username and password controls. When the dialog was OK'ed, my app would write the user's login to a text file stored on a network share.

Next I had to find a way to get my app onto the PM's system without him knowing it. I figured out that if I gave my program the same icon as MS Word, it would look like a Word document when it was attached to an MS Mail message (this was before email clients started blocking EXEs). So I modified the program to load a document into MS Word when it was executed - that way, when the "victim" double-clicked the attachment icon, it would act just like he'd double-clicked a Word document.

When I was confident that my little program worked, I emailed it to the PM. Later that day I checked the network share for the text file containing his login, and sure enough it was there. Suffice to say, his eyes got bigger than should be humanly possible when I showed him his username and password.

I have to admit, I was pretty pleased with my cracking skills when I pulled that off. And after Brent heard this story, he said that I missed my calling :)

Side note: after discovering how easy it was to sniff passwords with a simple VB program, I emailed one of the editors of the Visual Basic Programmer's Journal, which was the leading magazine for VB developers back then. He got in touch with someone at Microsoft about this, and they told him something along the lines of "yeah, that's a known problem with Windows 3.1." Oh, and the name of the editor I contacted was Robert Scoble, who later joined Microsoft and became their most famous blogger. I wonder if he remembers my email?