The Khronos Group, which officially released WebGL 1.0 in March, defended the security credentials of the standard. "We think it is important to raise awareness of this issue before WebGL becomes more widely adopted because this is not an implementation problem, but is down largely to the WebGL specification, which is inherently insecure," Jordon added.Ĭontext said the problems were "inherent to the WebGL specification and would require significant architectural changes in order to remediate in the platform design." WebGL, which can be switched on in Apple's Safari browser as well, is becoming more widely used in modern smartphones, the security firm noted. "While this may be true for local applications, the use of WebGL-enabled browser-based applications with certain graphics cards now poses serious threats from breaking the cross domain security principle to denial of service attacks, potentially leading to full exploitation of a user's machine." "The risks stem from the fact that most graphics cards and drivers have not been written with security in mind so that the interface (API) they expose assumes that the applications are trusted," said Michael Jordon, research and development manager at Context. Therefore WebGL could allow for the creation of shader programs designed to suck up the targeted computer's power, effectively carrying out a denial of service attack and preventing the user from accessing their machine, according to Context. In comparison, with 2D graphic acceleration, the actual functionality of the GPU is not directly exposed to a webpage. The code could then exploit flaws in unpatched graphics drivers, meaning the GPU could be attacked causing a machine to completely shut down.Ĭontext said one of the central issues was that WebGL provides access to the graphics hardware. If a user visited a site with malicious WebGL script, the WebGL component would then upload a specified 3D code to the end user's graphics card, Context said in a blog post.
The flaws could hand hackers low level access to graphics cards, potentially providing a back door for cyber criminals looking to get their hands on user data. The US Computer Emergency Readiness Team (US-CERT) recommended users turn off WebGL, designed to display 3D graphics in browsers on any machine, after Context Information Security found problems in the rendering tool. Web users have been told to turn off the WebGL 3D rendering engine in Firefox 4 and Google Chrome due to security issues.
0 kommentar(er)
