WebGL Vulnerable to Security Breaches

from JoeUser Forums

 

 

Big deal. What’s WebGL?

WebGL (Web Graphics Library) is an in development standard specification defining a JavaScript API for writing web applications utilizing hardware accelerated 3D graphics.

So, this is quite upsetting to the makers of Firefox and Chrome and that’s because they use it in all their versions since 4.x and 9.x, respectively. OK, they’ll patch it. Nope. The very architecture of webGL is what makes it vulnerable, and that’s going to make it very hard to fix.

Your antiviral/antimalware protect the usual routes of attack. They don’t protect your graphics card. That’ll be the route of attack…. Haha! Dumb Windows usres! Switch to Mac!

Nope, Windows, Linux and Apple OS’s are all vulnerable – oh yes, the Safari currently under development is vulnerable too.

The flaws researched by UK consultancy Context Information Security are serious enough, the company said, to allow an attacker to compromise the attacked PC through the poorly defended graphics card layer, or at the very least crash the system to make it more vulnerable to exploits.

The company confirmed that it had been able to exploit systems using proof-of-concept attacks with certain graphics cards in a way -- kernel mode -- that breached the most secure ring of an OS. – PCWorld

"The risks stem from the fact that most graphics cards and drivers have not been written with security in mind so that the interface (API) they expose assumes that the applications are trusted," said Context Research and Development Manager Michael Jordan.

Disabling WebGL in Firefox 4

Disabling WebGL varies from browser to browser but in Firefox involves setting a required value to "false" using the “about:config” command.

1. Type about:config in Firefox address bar and continue with warning dialog.

2. Type Webgl in the Filter box double click “ webgl.enabled_for_all_sites”  and set its value to False.

3. Restart Firefox browser, WebGL is now disabled in Firefox 4.

From Techdows.

I’ve looked for instructions on how to do the same for Chrome, but can’t find any… unless you’re a programmer working for Google.

Source: http://www.pcworld.com/businesscenter/article/227434/webgl_hit_by_hardtofix_browser_security_flaw.html

77,131 views 46 replies
Reply #1 from WinCustomize Forums Top

Curious. I have it open now. All it says top line...webgl.disabled       default       boolean            false

the...webgl.enabled_for_all_sites is not there. Another says webgl.force_enabled and on the end false

Then force_osmesa

osmesalib

shader.validator

verbose           that's it.

Reply #2 from WinCustomize Forums Top

Sounds good. Try doing the same with Pale Moon. 

 

Sins of a Solar Empire: Rebellion
Reply #3 from JoeUser Forums Top

Same here for PaleMoon - no such entry in about:config.

Reply #4 from JoeUser Forums Top

Try doing 'what' with PaleMoon?  He didn't 'do' anything, just reported what the webgl filter brought up.

Reply #5 from WinCustomize Forums Top

So, if one was to  set it to false (webgl.enabled_for_all_sites”  and set its value to False).

what would it do to surfing sites like would stuff not load.. what is the drawl back in setting it to False

Reply #6 from WinCustomize Forums Top

I set webgl.disabled to true the default value was false.

Reply #7 from WinCustomize Forums Top

Quoting Daiwa, reply 4
Try doing 'what' with PaleMoon?  He didn't 'do' anything, just reported what the webgl filter brought up.
End of Daiwa's quote

Was suggesting he disable webGL in Pale Moon... since Pale Moon is essentially Firefox optimized for Windows.

Reply #8 from WinCustomize Forums Top

Quoting DisturbedComputer, reply 5
So, if one was to  set it to false (webgl.enabled_for_all_sites”  and set its value to False).

what would it do to surfing sites like would stuff not load.. what is the drawl back in setting it to False
End of DisturbedComputer's quote


It won't "do" anything except disable hardware acceloeration and render you less vulnerable to webGL based attacks. 

 

Quoting BigDogBigFeet, reply 6
I set webgl.disabled to true the default value was false.
End of BigDogBigFeet's quote
 

BDBF: Set it to false. 

Reply #9 from WinCustomize Forums Top

Quoting DrJBHL, reply 8
BDBF: Set it to false.
End of DrJBHL's quote

Quoting DrJBHL, reply 8
I set webgl.disabled to true the default value was false.
End of DrJBHL's quote

 

lol Doc the default value of webgl.disabled is false.  I take that to mean that is webgl is enabled.

Hence I set web.disbaled to true so that webgl will be disabled.

Reply #10 from WinCustomize Forums Top

Quoting DrJBHL, reply 8
BDBF: Set it to false. 
End of DrJBHL's quote

I think BDBF has this one right, Doc. webgl.disabled needs to be set to true ...

http://madebyevan.com/webgl-path-tracing/  To test if webgl is on

Reply #11 from WinCustomize Forums Top

ok cool

 

I went to about:config but I do not have any that say (webgl.enabled_for_all_sites) so when you say this are you saying for all Webgl

here are the ones i do have

Preference Name            Status     Type     Value
 
webgl.disabled               Default   Boolean    False
webgl.force-enabled       Default   Boolean    False
webgl.force_osmesa       Default   Boolean    False
webgl.osmesalib             Default   String       
webgl.prefer-native-gl    Default    Boolean   False
webgl.shader_validator   Default   Boolean   True
webgl.verbose                Default   Boolean   False

 

EDIT

just so I am Clear do I set them all to True?

Reply #12 from WinCustomize Forums Top

Quoting tazgecko, reply 10
I think BDBF has this one right, Doc. webgl.disabled to needs to be set to true ...

http://madebyevan.com/webgl-path-tracing/ To test if webgl is on
End of tazgecko's quote

is that link ok cause I click on it 2 times and both times it crashed FF 4.0.1and sent a report to them ?

 

works with IE 9  the link that is

Reply #13 from WinCustomize Forums Top

Thx taz.  Your link shows that my web browser does not support webgl.  I'm running FF 4 and I changed one default setting as indicated above.

Reply #14 from WinCustomize Forums Top

:sun:

 

Reply #15 from WinCustomize Forums Top

Quoting BigDogBigFeet, reply 9
Hence I set web.disbaled to true so that webgl will be disabled.
End of BigDogBigFeet's quote

Kerekt.

Reply #16 from WinCustomize Forums Top

Quoting tazgecko, reply 14
It works fine on my computer / palemoon.

could be a driver problem or firefox, I'll take it down anyway, DC ... we don't want people's programs crashing
End of tazgecko's quote

no need to take it now right down it might just be my side

cause it is working in IE 9

just not my FF 4.0.1

Reply #17 from JoeUser Forums Top

How's this:

webgl.disabled - set to true (default is false)

webgl.force-enabled - set to false (default is true)

Looks like that would have you covered.

Have no idea what osmesa is.

Reply #18 from Elemental Forums Top

off-screen Mesa

 

...whatever that is

Reply #19 from WinCustomize Forums Top

Quoting Daiwa, reply 17
How's this:

webgl.disabled - set to true (default is false)

webgl.force-enabled - set to false (default is true)

Looks like that would have you covered.

Have no idea what osmesa is.
End of Daiwa's quote

 

was this for me? if so thanks for the info..

this one is good as my Default is False

webgl.force-enabled - set to false (default is true)

Reply #20 from WinCustomize Forums Top


 
 
 
Disabling WebGL varies from browser to browser but in Firefox involves setting a required value to "false" using the “about:config” command.
1. Type about:config in Firefox address bar and continue with warning dialog.
2. Type Webgl in the Filter box double click “ webgl.enabled_for_all_sites”  and set its value to False.
3. Restart Firefox browser, WebGL is now disabled in Firefox 4.
 
End of quote


Reply #21 from WinCustomize Forums Top

Quoting DisturbedComputer, reply 11
ok cool

 

I went to about:config but I do not have any that say (webgl.enabled_for_all_sites) so when you say this are you saying for all Webgl

here are the ones i do have

Preference Name            Status     Type     Value
 
webgl.disabled               Default   Boolean    False
webgl.force-enabled       Default   Boolean    False
webgl.force_osmesa       Default   Boolean    False
webgl.osmesalib             Default   String       
webgl.prefer-native-gl    Default    Boolean   False
webgl.shader_validator   Default   Boolean   True
webgl.verbose                Default   Boolean   False

 

EDIT

just so I am Clear do I set them all to True?
End of DisturbedComputer's quote

 

Only the top line DC. Set that one to true (just double click). The others stay the same.

Reply #22 from Elemental Forums Top

Pale Moon doesn't have "webgl.enabled_for_all_sites" just "webgl.disabled".  So in this case I think Pale Moon 4 *is* different to Firefox 4.

Best regards,
Steven.

Reply #23 from WinCustomize Forums Top

Quoting StevenAus, reply 22
Pale Moon doesn't have "webgl.enabled_for_all_sites" just "webgl.disabled".  So in this case I think Pale Moon 4 *is* different to Firefox 4.

Best regards,
Steven.
End of StevenAus's quote

Yeh, I think in Pale Moon is enough to set "webgl.disabled" on True (by default is False, that means webgl is enabled)

Reply #24 from WinCustomize Forums Top

Quoting Uvah, reply 21
Only the top line DC. Set that one to true (just double click). The others stay the same.
End of Uvah's quote

 

thanks Uvah it is now set to true

Reply #25 from JoeUser Forums Top

Quoting Daiwa, reply 3
Same here for PaleMoon - no such entry in about:config.
End of Daiwa's quote

Ok, reading more comments, I understand what you did not find.  Thanks all for clearing that up!

I found it - webgl.disabled;false  And it is disabled thankfully.  Thanks for the tip again Doc!