Jump to content

Webp Virus, fears, nightmares, suggestions, or exodus from the internet?

Dixel

By Dixel
in Web Browsers

 Share

Recommended Posts

Dixel

Dixel

Posted
Posted

I can suggest, as a quick fix, to search chrome.dll and replace all occurrences of "webp,image" with "apng,image", without quotes. Use any HEX edit software, make a backup before!

With this dirty, nasty hack, your browser supposed to not accept webp virus, though I don't know if the website you visit don't support any other formats, so test it and report here!

You aren't losing anything, since it's a junk, low quality format, to begin with.

And what are you gonna do? Please share your fears, suggestions, opinions.

Check here:

OLD (before the edit)

image/avif,image/webp,image/apng,image/svg+xml,image/

NEW (after the edit)

image/avif,image/apng,image/apng,image/svg+xml,image/

https://www.amiunique.org/fingerprint

This will make you unique, so proceed with caution, good luck!

4
Link to comment
Share on other sites

Dixel

Dixel

Posted
  • Author
Posted

What does the test page tell you? Post the screenshot please.

Did you disable Client Hints? 

After the edit it should be.

image/avif,image/apng,image/apng,image/svg+xml,image/

It's the header which tells the sites what's your browser can accept.

3
Link to comment
Share on other sites
Dixel

Dixel

Posted
  • Author
Posted
3 hours ago, Tripredacus said:

Webp being such a terrible idea, how about any methods to block it at the OS level, no matter what browser you are using? Since as I am reading, the WEBP vulnerability is not limited to Chrome or even Windows.

Obviously don't use Windows gallery anymore, pick some old software without webp format, to browse pics on your PC/laptop. Then make that programme default, so you won't accidentally open webp with native windows tools.

I use the famous German NERO 8 (yes very old, 2007 or so). It doesn't know what webp is, so If I click on webp, even without extension, it doesn't know what to do with it.

2
Link to comment
Share on other sites
Dixel

Dixel

Posted
  • Author
Posted
3 hours ago, Tripredacus said:

Webp being such a terrible idea, how about any methods to block it at the OS level, 

At the OS level, uninstall all third party codecs, if you have any, ASAP. Any codec sets that add webp codec to the OS (K-lite and the such). Also, I suggest to uninstall all VP8 codec iterations, since it's basically the same with webp.

For example, the famous French VLC player doesn't need any codecs in the system, it has its own.

3
Link to comment
Share on other sites
rereser

rereser

Posted
Posted (edited)

New Moon 28 with setting "image.webp.enabled" to false :
webp images on https://developers.google.com/speed/webp/gallery1 are not loaded , so that works.

when testing 360Chrome 13.5.2036 against the amiunique.org site , the http header is changed after the dll edit as you posted.
but the webp images on developers.google.com are still displayed.

https://superuser.com/questions/1179401/how-to-disable-webp-images-in-chrome
the suggestion posted here : change the "Accept Request Header" and the "user agent" to a non webp supported browser also has no effect on 360Chrome.

just my results as you requested.

my opinion : this "threat" will vanish as soon as it became public.
with every major browser now patched , software and even on the OS level there is nothing to exploit.
the "common user" is not even the target.

Edited by rereser
1
Link to comment
Share on other sites
UCyborg

UCyborg

Posted
Posted (edited)

I vote for exodus from the internet.

But if that's not possible, cut the internet use to the minimum, especially over-engineered complex websites, use less known web browsers, less known OS etc.

In the grand scheme of things, this vulnerability is already history. They won't target some weirdos holding onto historic OS/browsers. Surely some new one may appear some day, for that case, read the previous paragraph again.

Edited by UCyborg
1
Link to comment
Share on other sites
AstroSkipper

AstroSkipper

Posted
Posted (edited)
42 minutes ago, rereser said:

New Moon 28 with setting "image.webp.enabled" to false :
webp images on https://developers.google.com/speed/webp/gallery1 are not loaded , so that works.

@roytam1 has already fixed this security vulnerability in his latest release of New Moon 28:

On 9/16/2023 at 1:36 AM, roytam1 said:

New build of Serpent/UXP for XP!

Test binary:
Win32 https://o.rthost.win/basilisk/basilisk52-g4.8.win32-git-20230916-3219d2d-uxp-58a39ca8cb-xpmod.7z
Win64 https://o.rthost.win/basilisk/basilisk52-g4.8.win64-git-20230916-3219d2d-uxp-58a39ca8cb-xpmod.7z

source code that is comparable to my current working tree is available here: https://github.com/roytam1/UXP/commits/custom

IA32 Win32 https://o.rthost.win/basilisk/basilisk52-g4.8.win32-git-20230916-3219d2d-uxp-58a39ca8cb-xpmod-ia32.7z

source code that is comparable to my current working tree is available here: https://github.com/roytam1/UXP/commits/ia32

NM28XP build:
Win32 https://o.rthost.win/palemoon/palemoon-28.10.7a1.win32-git-20230916-d849524bd-uxp-58a39ca8cb-xpmod.7z
Win32 IA32 https://o.rthost.win/palemoon/palemoon-28.10.7a1.win32-git-20230916-d849524bd-uxp-58a39ca8cb-xpmod-ia32.7z
Win32 SSE https://o.rthost.win/palemoon/palemoon-28.10.7a1.win32-git-20230916-d849524bd-uxp-58a39ca8cb-xpmod-sse.7z
Win64 https://o.rthost.win/palemoon/palemoon-28.10.7a1.win64-git-20230916-d849524bd-uxp-58a39ca8cb-xpmod.7z

Official UXP changes picked since my last build:
- Issue #2301 - Make Gecko Media Plugins optional when not building EME or WebRTC (9e7d1492e6)
- Issue #2309 - Cherry-pick upstream libwebp fix. (20b69d7ddc)

No official Pale-Moon changes picked since my last build.

No official Basilisk changes picked since my last build.

My changes picked since my last build:
- [libwebp] Fix OOB write in BuildHuffmanTable. (61de658e45)
- [libwebp] Fix invalid incremental decoding check. (3b44f9850e)
- configure: move MOZ_GMP define block after MOZ_EME (f5cacdadbf)
- dom/media: more eme fixes (58a39ca8cb)

Update Notice:
- You may delete file named icudt*.dat inside program folder when updating from old releases.

* Notice: From now on, UXP rev will point to `custom` branch of my UXP repo instead of MCP UXP repo, while "official UXP changes" shows only `tracking` branch changes.

Therefore, setting the pref image.webp.enabled to false is not really needed anymore.

Edited by AstroSkipper
1
Link to comment
Share on other sites
Sampei.Nihira

Sampei.Nihira

Posted
Posted (edited)

For you who use browsers that are probably not already patched, I am including the fix that is valid for Chromium-based browsers:

https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a

https://github.com/webmproject/libwebp/releases/tag/v1.3.2

 

For Firefox:

https://hg.mozilla.org/releases/mozilla-release/rev/e245ca2125a6eb1e2d08cc9e5824f15e1e67a566

 

P.S.

Pale Moon has already fixed this vulnerability.

Edited by Sampei.Nihira
1
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...