Time to disable WebGL ?

Published: 2011-05-11
Last Updated: 2011-05-11 16:51:00 UTC
by Swa Frantzen (Version: 3)
6 comment(s)

WebGL ? I had never heard of WebGL before and I'm sure quite a few among our readers are in the same boat. Yet it is implemented in Firefox 4, Chrome and Safari browsers and apparently even turned on by default in Firefox 4 and Chrome. Yet, there's something wrong with its security.

So what is WebGL?

It's a way to let components on webpages display 3D models using the full power of the graphics card in the computer. Effectively this exposes some portions of the graphics card's software via the browser to the Internet. 

US-CERT recommends to turn off WebGL in the browsers that do support it (Firefox 4, Chrome, Safari (not enabled by default))

I've looked on my mac how to enable/disable WebGL in Firefox 4, Chrome and Safari, but have been unsuccessful so far as to find even a mention of WebGL in any of them [see below].

References and far more detail:

Thanks go to James for the heads-up.

Update: how to disable webgl in firefox 4.0.1:

Type about:config in the address bar. And toggle the webgl.disabled variable to true.
I can confirm this stops webgl from working on demo sites that explain how to use webgl such as http://www.webkit.org/blog-files/webgl/SpiritBox.html. Shows a spinning box if you have webgl, and a rectangle if you don't.

Update: how to disable webgl in chrome:

It needs the --disable-webgl argument on the command line

Update: we will from now on need to keep a much more careful eye on the security issues of graphic card drivers, and get these updated if and when they fix security issues.

Update: if you're using derived browsers from one of the affected browsers, it's a good idea to check if they support WebGL and then contact the makers in order to figure out how to disable it.

Swa Frantzen -- Section 66

Keywords: webgl
6 comment(s)


firefox - browse to "about:config" and enter "webgl" in the filter. Double-click on "webgl.disabled".
Chrome on Mac ... chrome://plugins should have it listed, but its not there in v11.
For Chrome here is a list of all the about:config like pages: hxxp://googlesystem.blogspot.com/2008/09/google-chromes-about-pages.html
The same day as http://chrome.angrybirds.com comes out! Sheesh...
What is the big issue here ?
Code is executed on a GPU, which has limited access to the main computer.
It is many years ago, that Microsoft did do away with putting drivers in the outer ring for security. I think it was Windows 2000 or XP, they moved graphics drivers to kernel mode, to ensure all users could exploit vulnerabilities in the graphics drivers to do whatever they wanted.

BTW: If this is such a big issue, we also need instructions on how to disable the hardware acceleration of Flash, it is probably in the same league.
I would be more worried about them using the general processing APIs like CUDA or STREAM to accelerate malware functions - whether that's local password cracking or whatever it opens up a massive amount of computing resources that the average user may not even notice is in use.

Diary Archives