DrJBHL DrJBHL

WebGL Vulnerable to Security Breaches

▼

WebGL Vulnerable to Security Breaches

from JoeUser Forums

 

 

Big deal. What’s WebGL?

WebGL (Web Graphics Library) is an in development standard specification defining a JavaScript API for writing web applications utilizing hardware accelerated 3D graphics.

So, this is quite upsetting to the makers of Firefox and Chrome and that’s because they use it in all their versions since 4.x and 9.x, respectively. OK, they’ll patch it. Nope. The very architecture of webGL is what makes it vulnerable, and that’s going to make it very hard to fix.

Your antiviral/antimalware protect the usual routes of attack. They don’t protect your graphics card. That’ll be the route of attack…. Haha! Dumb Windows usres! Switch to Mac!

Nope, Windows, Linux and Apple OS’s are all vulnerable – oh yes, the Safari currently under development is vulnerable too.

The flaws researched by UK consultancy Context Information Security are serious enough, the company said, to allow an attacker to compromise the attacked PC through the poorly defended graphics card layer, or at the very least crash the system to make it more vulnerable to exploits.

The company confirmed that it had been able to exploit systems using proof-of-concept attacks with certain graphics cards in a way -- kernel mode -- that breached the most secure ring of an OS. – PCWorld

"The risks stem from the fact that most graphics cards and drivers have not been written with security in mind so that the interface (API) they expose assumes that the applications are trusted," said Context Research and Development Manager Michael Jordan.

Disabling WebGL in Firefox 4

Disabling WebGL varies from browser to browser but in Firefox involves setting a required value to "false" using the “about:config” command.

1. Type about:config in Firefox address bar and continue with warning dialog.

2. Type Webgl in the Filter box double click “ webgl.enabled_for_all_sites”  and set its value to False.

3. Restart Firefox browser, WebGL is now disabled in Firefox 4.

From Techdows.

I’ve looked for instructions on how to do the same for Chrome, but can’t find any… unless you’re a programmer working for Google.

Source: http://www.pcworld.com/businesscenter/article/227434/webgl_hit_by_hardtofix_browser_security_flaw.html

77,133 views 46 replies
Reply #26 from Elemental Forums Top

Actually in Pale Moon webgl.disabled must be true.  webgl.disabled being false means it *isn't* disabled (double negative).  Agreed it is quite confusing the way Pale Moon has done it, but basically the webgl option must be the opposite of the default, unmodded value in either Firefox or Pale Moon (that is, respectively, webgl.enabled_for_all_sites=false or webgl.disabled=true).

Best regards,
Steven.

Reply #27 from WinCustomize Forums Top

In other words it means the same thing

Siege of Centauri
Reply #28 from WinCustomize Forums Top

Quoting StevenAus, reply 26
Actually in Pale Moon webgl.disabled must be true.  webgl.disabled being false means it *isn't* disabled (double negative).  Agreed it is quite confusing the way Pale Moon has done it, but basically the webgl option must be the opposite of the default, unmodded value in either Firefox or Pale Moon (that is, respectively, webgl.enabled_for_all_sites=false or webgl.disabled=true).

Best regards,
Steven.
End of StevenAus's quote

StevenAus understood correctly.

Reply #29 from WinCustomize Forums Top

I'm not sure if this is at all helpful, but in doing a search to disable in Chrome, it was mentioned to issue a command line switch:

chrome.exe--disable-webgl

Not sure how to do this.  Hopefully someone will know.

Reply #30 from JoeUser Forums Top

Wonder what the 'webgl.force-enabled' is all about.  The default for that is True in PaleMoon here.

Reply #31 from WinCustomize Forums Top

Daiwa - Then it should be changed to False, as I understand it. 

*doc takes this opportunity to ask Daiwa to update 'Granular' to Windows 7.   (Granular.greatskin. set to True) 

Reply #32 from WinCustomize Forums Top

As I understand it, webgl.force takes out the graphic safe guards.

Reply #33 from WinCustomize Forums Top

Then I'm glad I left that one alone.

Reply #34 from Elemental Forums Top

Notice in the Youtube video on ENABLING WebGL (the opposite of what we want) they only alter the webgl.force-enabled and don't touch the webgl.disabled option.

Reply #35 from JoeUser Forums Top

I'm starting to get vertigo - hoo wah wuh?.

Quoting tazgecko, reply 32
As I understand it, webgl.force takes out the graphic safe guards.
End of tazgecko's quote

I take it we'd want that one set to False? or True?

@Doc - thanks for the plug.  I've made dozens of tweaks to it since 2007 & (I think) it looks even nicer, but I'm still plodding along in an all-XP world so it will be awhile before I can do a Win7 version I'm afraid.  I've been thinking of uploading the current version (it's different enough to merit a slight variation on the name - Granuloid or Granulicious, something like that) some time soon.  One or two trivial image corrections still needed, but it should be ready before long.

Reply #36 from WinCustomize Forums Top

You set webgl.force-enabled to False if you want to turn it off. If you already have webgl off I can't see why it would have any effect. But better safe than sorry.

|-)

 

 

Reply #37 from JoeUser Forums Top
Not to spin this even further out of control, but 'removing safe guards' sounds like something I would not want to do. OK, gotta go get the Dramamine now.
Reply #38 from WinCustomize Forums Top

 

:sun:  

edited : didn't want to confuse the issue more.

 

Reply #39 from WinCustomize Forums Top

Well, here is a very interesting article on the issue http://www.theregister.co.uk/2011/05/11/chrome_firefox_security_threat/ . At the bottom you can find instructions on how to disable WebGL in Firefox and Chrome. 

About Firefox all is to set webgl.disabled to True. This because in the latest browser version , 4.0.1 , “webgl.enabled_for_all_sites” has been changed in “webgl.disabled” (same as in Pale Moon), as better specified here http://techdows.com/2010/12/disable-webgl-in-firefox-4.html.

Reply #40 from WinCustomize Forums Top

I'll say this ...... all this stuff is almost enough to make me sane. That's not good.

Reply #41 from JoeUser Forums Top

Quoting StevenAus, reply 26
Actually in Pale Moon webgl.disabled must be true.
End of StevenAus's quote

Yes, i set mine to true yesterday after reading the comments.  Sometimes the comments are more valuable than the article (except that article does inspire the comments so there is that).

Reply #42 from JoeUser Forums Top

Quoting happyboy7, reply 29
I'm not sure if this is at all helpful, but in doing a search to disable in Chrome, it was mentioned to issue a command line switch:

chrome.exe--disable-webgl

Not sure how to do this.  Hopefully someone will know.
End of happyboy7's quote

Probably need to create a shortcut and the modify the "target" line.

Reply #43 from WinCustomize Forums Top

Quoting happyboy7, reply 29
I'm not sure if this is at all helpful, but in doing a search to disable in Chrome, it was mentioned to issue a command line switch:

chrome.exe--disable-webgl

Not sure how to do this.  Hopefully someone will know.
End of happyboy7's quote

 

Please, have a look here http://techdows.com/2011/05/how-to-disable-webgl-in-chrome.html . Hope it can help.

Reply #44 from WinCustomize Forums Top

:yes:

Thanks everybody.

Reply #45 from WinCustomize Forums Top

Quoting Daiwa, reply 35
I'm starting to get vertigo - hoo wah wuh?.

Quoting tazgecko, reply 32As I understand it, webgl.force takes out the graphic safe guards.

I take it we'd want that one set to False? or True?

@Doc - thanks for the plug.  I've made dozens of tweaks to it since 2007 & (I think) it looks even nicer, but I'm still plodding along in an all-XP world so it will be awhile before I can do a Win7 version I'm afraid.  I've been thinking of uploading the current version (it's different enough to merit a slight variation on the name - Granuloid or Granulicious, something like that) some time soon.  One or two trivial image corrections still needed, but it should be ready before long.
End of Daiwa's quote

Granuloma? Granulation? 

Reply #46 from WinCustomize Forums Top

Granuloidalicious. :w00t: