Recently, we came across the new browser security tool released by QUALYS termed as BrowserCheck . In general, this tool scrutinizes and verifies the state of plug-ins in Mozilla browser. As stated in the information week article "Less-than-current browser and plug-in versions can leave your browsing unnecessarily vulnerable to web-based attacks... and make latest-and-greatest-based web sites harder or impossible to use, but Qualys' free BrowserCheck can help."
Well, in general the tool is designed as a simple version based signature tool. However, the tool uses a PHP based version verifier script that runs on server side. An appropriate XMLHttpRequest is used to send the browser based information which we termed as User Agent Based Fingerprinting (UABF).
Conversely, this technique is used in the wild by all the classes of malware to detect the state of browsers (version, addons, plug-ins etc). Apart from this, malware is served based on the type of version running. A similar plug-in detection script can be compiled using navigator object as
Further, it is also detected that the tool is using JavaScript + XMLHTTPRequest collectively to find the information from client machine. During the course of testing, we conducted a small test in order to scrutinize whether Java applet is loaded in the system or not in order to verify the semantics of tool. Generally, Java plug-in version can be checked by using a simple Java applet as follows
import java.applet.*;
import java.awt.*;
public class JavaVersionDisplayApplet extends Applet
{ private Label m_labVersionVendor;
public JavaVersionDisplayApplet() //constructor
{
m_labVersionVendor = new Label (" Java Version: " +
System.getProperty("java.version")+
" from "+System.getProperty("java.vendor"));
this.add(m_labVersionVendor);
}
}
The Java client side environment is not triggered on the test machine which clearly indicates that fingerprinting is done using simple tactics. While running the tool on one of our test bed machines, we found that the data is transferred as
{"ScanInfo":
{"Platform":"Microsoft Windows Vista Home Premium Edition, 64-bit Service Pack 2","Browser":"Mozilla Firefox 3.6.13","AgentVer":"1.1.95.1","SADllVer":"1.1.95.1","InstanceId":"72904d0d-a58e-409d-afa3-922d1c8a71cd","ScanId":"5"},
"ScanResults":[{"Status":"Up To Date","ItemType":"Browser","ItemName":"Mozilla Firefox","FoundVer":"3.6.13","ProductVer":"3.6.13","RequiredVer":"3.6.13.0",
"FixInfo":"http://www.mozilla.com/en-US/firefox/upgrade.html"},
{"Status":"Up To Date","ItemType":"Browser Extra","ItemName":"Adobe Flash Player","FoundVer":"10.2.152.26","InstalledFile":"c:\\windows\\syswow64
\\macromed\\flash \npswf32.dll","ProductVer":"10.2.152.26","RequiredVer":"10.2.152.26",
"AdvisoryUrl":"http://www.adobe.com/support/security/advisories/apsa10-05.html","AddonType":"Plugin","FixInfo":"http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe"},
{"Status":"Up To Date","ItemType":"Browser Extra","ItemName":"Adobe Reader","FoundVer":"10.0.1.434","InstalledFile":"c:\\program files
(x86)\\adobe\\reader 10.0\\reader\\browser \\nppdf32.dll","ProductVer":"10.0.1.434","RequiredVer":"10.0.1.434",
"AddonType":"Plugin","FixInfo":"http://get.adobe.com/reader"},
{"Status":"Up To Date","ItemType":"Browser Extra","ItemName":"Java Runtime","FoundVer":"1.6.0_22","ProductVer":"1.6.0_22",
"RequiredVer":"1.6.0_24","RecommendedVer":"Latest Version of Java","AddonType":"Plugin","FixInfo":"http://www.java.com/getjava/index.jsp"},
{"Status":"Up To Date","ItemType":"Browser Extra","ItemName":"Microsoft Silverlight","FoundVer":"4.0.60129.0","InstalledFile":"c:\\program files (x86)\\microsoft silverlight\\4.0.60129.0\\npctrl.dll","ProductVer":"4.0.60129.0","RequiredVer":"4.0.60129.0",
"AddonType":"Plugin","FixInfo":"http://www.microsoft.com/getsilverlight/handlers/getsilverlight.ashx"},
{"Status":"NA","ItemType":"Browser Extra","ItemName":"Microsoft
Windows Presentation Foundation","FoundVer":"3.5.30729.1","InstalledFile":"",
"ProductVer":"3.5.30729.1","RequiredVer":"3.5.30729.1",
"AddonType":"Plugin","FixInfo":"http://www.microsoft.com/downloads/"},
{"Status":"Up To Date","ItemType":"Browser Extra","ItemName":"Microsoft
Windows Media Player","FoundVer":"11.0.6002.18311","InstalledFile":"C:\\Windows\\system32\\wmp.dll","ProductVer":"11.0.6002.18311",
"RequiredVer":"11.0.6002.18311","AddonType":"Plugin",
"FixInfo":"http://www.microsoft.com/downloads/en/confirmation.aspx?
familyid=277151A2-B74F-4DA6-8203-E774AF75E44C&displaylang=en"}]}
This scan info completely leverages the working stature of the tool. However, the technique is not new but one can notice that signature based tools are still widely used.
The next question is to see the way this tool reacts when a malicious plug-in (having updated version information) is installed in the browser.
