Users don't have to use the browser, only have it installed
According to the researcher's explanation, attackers could send malicious commands to an RPC endpoint that was left open in the browser's core engine.
These commands could be bundled inside malicious JavaScript code which was executed locally on the user's computer, where localhost access would allow it to reach these open RPC endpoints, even if SafeZone was not actually running, and the malicious links were clicked inside other browser.
An attacker wouldn't even need an info-stealing malware strain if he knew his target had Avast's SafeZone installed, browser which was dumping everything out in the open.
"Although this attack relies on Avastium (Avast's port of Chromium), the victim does *not* have to be using it, and never has to have used it, because your profile is automatically imported from Chrome on startup," Mr. Ormandy noted, saying that bookmarks, preferences, passwords and cookies are automatically added to SafeZone without the user's consent.
Avast purposely disabled a Chromium security feature
"Additionally, you can send arbitrary *authenticated* HTTP requests, and read the responses," Mr. Ormandy also explained. "This allows an attacker to read cookies, email, interact with online banking and so on."
If you have SafeZone installed on your PC, you're doomed, since the malicious link can be opened in other browsers, and work regardless.
This entire situation is extremely funny and tragic at the same time.
Users that purchased an antivirus to bolster their security are practically being delivered a live backdoor, even if they wanted it or not.
Ormandy told Avast about their problem on December 18, and ten days later, the company issued a quick fix that prevented this issue from being exploited. The latest version of the Avast antivirus released on February 3 included a complete fix for this issue.
The Google researcher blamed this entire fiasco on Avast decision to overwrite a security feature inside the default Chromium setup. This feature allowed only WebSafe URLs to be opened via command-line instructions (like the malicious ones sent to the open RPC endpoint).
In Chromium, users would only be allowed to open links from the command line if the URL started with http, https, javascript, data, etc.. In SafeZone, attackers could also launch links that started with "file://" which is the URL naming scheme used to access local files.
As an advice to all antivirus makers that create their own "secure browsers:" Leave Chromium's security features alone!
Accessing
this URL will tell you if you have a vulnerable version of the SafeZone browser installed on your PC.
And yet another case of forking Chromium for "security" because of your virus expertise. Seriously, you're going to screw it up. — Tavis Ormandy (@taviso)
February 3, 2016
