"Bruggling" emerges as a novel technique for pilfering data out or for sneaking in malicious code

guest · Aug 1, 2022

Chromium Browsers Allow Data Exfiltration via Bookmark Syncing
August 1, 2022

To wit: Bookmarks can be abused to siphon out reams of stolen data from an enterprise environment, or to sneak in attack tools and malicious payloads, with little risk of being detected.

David Prefer, an academic researcher at the SANS Technology Institute, made the discovery as part of broader research into how attackers can abuse browser functionality to smuggle data out from a compromised environment and carry out other malicious functionality.
Click to expand...

In a recent technical paper, Prefer described the process as "bruggling" — a portmanteau of browser and smuggling. It's a novel data exfiltration vector that he demonstrated with a proof-of-concept (PoC) PowerShell script called "Brugglemark" that he developed for the purpose.
The Fine Art of Bruggling

"There's no weakness or vulnerability that is being exploited with the synchronization process," Prefer stresses.
The benefit of the technique is, put simply, stealth.
Click to expand...

Johannes Ullrich, dean of research at the SANS Institute, says data exfiltration via bookmark syncing gives attackers a way to bypass most host and network-based detection tools. To most detection tools, the traffic would appear as normal browser synch traffic to Google or any other browser maker.

Prefer's research was primarily focused on browser market share leader Google Chrome — and to a lesser extent on other browsers such as Edge, Brave, and Opera, which are all based on the same open source Chromium project that Chrome is built upon. But there's no reason why bruggling won't work with other browsers such as Firefox and Safari, he notes.
Click to expand...

Bookmark Bruggling: Novel Data Exfiltration with Brugglemark

Modern web browsers like Chrome, Edge, Safari, and Firefox are ubiquitous, and built-in synchronization capabilities have long since become a standard feature. For even longer, browsers have enabled users to save and edit bookmarks and the names and links stored for each.

Where bookmarks were once confined to the device that saved them, this research describes how the ability to synchronize bookmarks across devices introduces a novel vector for data exfiltration and other misuses. As a part of this effort, Brugglemark is a basic PowerShell script that has been created to demonstrate the practical application of the findings presented. Potential countermeasures will also be explored in this paper.
Click to expand...

Log in or Sign up

"Bruggling" emerges as a novel technique for pilfering data out or for sneaking in malicious code

guest Guest

Log in or Sign up

"Bruggling" emerges as a novel technique for pilfering data out or for sneaking in malicious code

guest Guest

Useful Searches