Finding and Exploiting Access Control Vulnerabilities in Graphical User Interfaces
summary
Defines GEMs as UI-element misuse that lets attackers bypass in-app access control, documents three concrete classes (unauthorized callback execution, information disclosure, information modification), and ships an automated tester GEM Miner for Windows that uses Win32 SendMessage and UI inspection to explore, record widget states, flip visibility/enable and inject values, then confirm persistence (including after restart). Demonstrations show enabling disabled buttons to trigger privileged callbacks, dangling information disclosure of admin data, and multiple previously unknown vulnerabilities in commercial desktop apps.
AI-written summary · about
chapters (39)
- 0:00Start
- 1:00Graphical User Interfaces (GUI)
- 1:19Agenda
- 1:55GUI Security History (Shatter Attacks)
- 2:53Graphical User Interfaces (GUIS)
- 3:07GUIS→ Widgets and Windows
- 3:25Widget Attributes
- 4:58Access Control in the GUI
- 5:50A Real World Attack DEMO
- 7:33Contributions
- 8:14Threat Model
- 9:05GUI Element Misuse (GEM)
- 10:28Unauthorized Callback Execution DEMO
- 15:53Unauthorized Information Disclosure DEMO
- 16:09Dangling Information Disclosure
- 18:34Unauthorized Data Modification DEMO
- 25:09Widget Configuration
- 25:30Technical
- 27:08UI Frameworks
- 27:52Win32 vs. .NET
- 31:08The GEM Miner Analysis
- 32:24The GEM Miner System
- 33:19Application Seeding
- 34:43UI Exploration - for all privilege levels
- 35:10GEM Candidate Identification
- 36:42GEM Candidates
- 37:38GEM Candidate Testing
- 38:41Testing Callback Widgets
- 38:53Testing for Information Disclosure
- 39:16Testing Data Modification GEMS 3/4
- 42:38Testing Data Modification GEMS 4/4
- 42:54Analyzing Real World Apps (Evaluation)
- 43:21Results - Callback GEMS
- 44:33Results - Information Disclosure GEMS
- 45:28Results - Information Modification GEMS
- 48:02Summary
- 48:44Other OSes and GUI Toolkits
- 50:36Countermeasures
- 53:05Conclusions
related talks
42mHacking With Gems
16mHacking Gemini & the MCP Permission Problem
40mThe Mechanisms That Enable Misuse and What We Can Do About It
31mTopics of Interest: Unlocking Mobile App Security Secrets
50mAutomated Discovery Of Logical Priv. Esc. Bugs In Win10
56m"Easy LPEs and Common Software Vulnerabilities"
24mBitcoin Web Application Security
46mNot My Vibe: When AI Coding Agents Go Off the Rails