Custom protocol handler exploit, seems to have no power here.

Unread post by **moonbat** » 2021-05-14, 04:19

From here -

n our research into anti-fraud techniques, we have discovered a vulnerability that allows websites to identify users reliably across different desktop browsers and link their identities together. The desktop versions of Tor Browser, Safari, Chrome, and Firefox are all affected.

We will be referring to this vulnerability as scheme flooding, as it uses custom URL schemes as an attack vector. The vulnerability uses information about installed apps on your computer in order to assign you a permanent unique identifier even if you switch browsers, use incognito mode, or use a VPN.

When I ran the test on PM, it just popped up the protocol handler dialog asking what to open with, and I canceled it. When I ran it in Chrome, there was a tiny popup window on the side as it rapidly enumerated all installed applications.

Unread post by **Moonchild** » 2021-05-14, 11:44

I didn't get the dialog but it hung just the same unable to get any information (even with the small pop-up opened)

Unread post by **moonbat** » 2021-05-14, 11:54

Do you have any protocol handlers in your profile? I have just one for Skype so it prompted me to pick one.

Unread post by **Moonchild** » 2021-05-14, 11:55

I think I have a few custom protocol handlers (e.g. for bank ID, btsync, and the like) and I've got some of them set to ask, others to just use the default application. But it can't query them by the looks of it so either way it fails.

Unread post by **moonbat** » 2021-05-14, 11:57

Maybe it's OS dependent. When I open the same page in Chromium it shows a warning that the test may not run properly on Chromium + Linux.

Unread post by **Moonchild** » 2021-05-14, 11:58

Possible, but they do state they tested it cross-platform so if it was possible to query UXP applications that way I'm sure it would happen.

Unread post by **vannilla** » 2021-05-14, 11:59

I got an "unexpected error" page.
Looks like I'm safe?

Unread post by **Moonchild** » 2021-05-14, 12:00

Funny. so 3 people tried it with 3 different results? XD

Unread post by **Lootyhoof** » 2021-05-14, 12:34

It looks like it's UA sniffing. If you have Firefox compatibility set or otherwise use a Firefox UA it shows the protocol handler box. If you use native or any UA that isn't one of the big browsers then it errors out.

Unread post by **vannilla** » 2021-05-14, 14:20

Still getting errors even when changing user agent strings... well, it's better this way so

(It's probably some "bad" interaction between the browser and the system, similar to how moonbat reported it not working with Chrome on Linux.)

Unread post by **moonbat** » 2021-05-14, 14:22

Times when security via obscurity helps

Not that it succeeds when you use a Firefox UA.

Unread post by **RealityRipple** » 2021-05-15, 19:52

Failed on the first try, detected Skype, Steam, and Battle.net apps when I closed the little window in the corner and refreshed the page.

Kinda surprised otpauth and magnet aren't on that list.

Pale Moon forum

Custom protocol handler exploit, seems to have no power here.

Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.

Re: Custom protocol handler exploit, seems to have no power here.