Breaching the Perimeter via Cloud Synchronized Browser Settings
summary
Cloud-synced browser settings allow extraction of passwords, credit cards and full-history GET parameters and can silently save passwords via three Edge settings so credentials arrive without user clicks. Start-page and home-button sync permit JavaScript and universal XSS to run domain-less payloads; file://, SMB and protocol handlers (JNLP) enable local file reads, auth coercion and remote JAR execution. Demonstrations include harvesting Tomcat admin creds, triggering WinRM CSRF, HTML smuggling drops chrome update.exe, and a tool called sinky emulates attacks to automate delivery; recommended mitigations are disabling sync and decoupling password managers.
AI-written summary · about
chapters (25)
- 0:00Cloud sync fundamentals
- 1:46Perimeter breach via sync
- 3:52Sync-based payload demo
- 4:12Today's talk outline
- 5:35Likelihood of sync compromise
- 5:56Case study: passive data theft
- 8:00Case study: start page attacks
- 10:47File protocol handlers
- 12:10External app triggers
- 13:14Sync-enabled malicious extensions
- 14:41Attack vectors summary
- 15:23Password theft via sync
- 16:25File exfiltration risks
- 17:29Code execution via sync
- 19:14Protocol handler vulns
- 20:16Tomcat sync compromise
- 21:21Lateral movement via sync
- 22:23Desktop sync risks
- 23:07Defensive strategies
- 24:09Enterprise prevention tips
- 25:12Detection methods
- 26:15Sinky sync emulator
- 27:18Sinky live demo
- 30:47Defender recommendations
- 31:39Q&A
related talks
55mSession Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers
33mHacking The Front-End
44mWhen you can't afford 0days: Client-side exploitation for the masses
34mToward Secure and Convenient Browsing Data Management in the Cloud
21mSecurity is Everyone's Responsibility
50mHTTP Desync Attacks: Smashing into the Cell Next Door
40mHostile JavaScript: Attacking and Defending the Browser
34mJS Security - A Pentesters Perspective