Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
The questions here are about shims in the 3 most commonly used browsers.
A shim (also known as polyfill) is a piece of code (often JavaScript or Flash) implemented to augment the native API in a web browser.
I have two questions about this technology:
A developer chooses to write a polyfill because it fulfills his personal need. From this personal aspect may come all problems you may imagine, namely malicious JavaScript code.
Can a shim be installed in IE, FF, or Chrome without user knowledge?
Surely. Drive-by download attacks which consist in malware delivery without the knownledge/consent of the visitor of a given compromised web application. Such attacks exploit vulnerabilities in the web browsers themselves or those of their installed plugins. Note that these plugins can either be innocuous but vulnerable, or malicious by design;
Does the code in the shim have access to login credentials entered by user on a web page?
Shim or not, as long an attacker succeeds to install and run some malicious JavaScript code within your browser, anything can happen. I have no better example to give you than the notorious ZombieBrowserPack. Which is an opensource project developed first as a POC by Zoltan Balazs, and targets some of the most used browsers (Chrome, Firefox and IE). This plugin can be manipulated remotely to steal authentication credentials, and even bypass two-factor authentication mechanisms such as the ones implemented by Yahoo and Google. It can also hijack your Facebook account, or get your bank account credentials if you perform an online purchase. You can imagine such a plugin purposed to fulfill this or that feature (shim) and doing something nefarious behind in the background.
A shim or polyfill does not get installed into a browser but gets delivered as part of a web page to provide functionality for this page. It is just normal active content (JavaScript, Flash...) which only gets named as shim or polyfill because it serves the specific purpose described by these names. It has no special permissions or restrictions compared to other active content.
Since it is nothing special it gets included into a web page the same way as other active content, for example using the script tag in case of JavaScript. And since a shim has no restrictions compared to other active content it can do anything what other active content can do too, including manipulating the DOM tree, capturing key strokes, reading content from input fields, accessing cookies for the page etc. But it has also all the restriction other active content has, that is that these actions are subject to the same origin policy etc. This means it can not capture passwords from third-party sites, but it can capture password from the site where the shim got included.
When including a shim/polyfill from a third party into your own web site you should be aware, that the content of the shim is outside of your control. It can not only vanish and thus break your site, but it can also be modified to include functionality you don't like (like capturing passwords). This can happen because the third party is malicious by itself or got hacked. This attack vector is not only relevant for shims but for any kind of active content you include from a third party source; i.e. Javascript libraries like jQuery, advertisements, like-buttons for social networks etc.
Thus if you need a shim it is better to copy it to your site so that you have full control over availability and modifications. You should have a look at the code to make sure that the shim itself does not include third party code by itself because then you would still have the same vulnerabilities.
A shim or polyfill isn't anything particularly special. It's just javascript code - the name is used to describe the task that it performs (i.e backfilling expected behaviour into older or incompatible browsers)
To answer your questions:
Can a shim be installed in IE, FF, or Chrome without user knowledge?
As shims and polyfills are just Javascript libraries, the most likely mode of infection would be a malicious browser extension. These are often installed by piggybacking off the install process of desktop applications. (Think search toolbars, etc)
Does the code in the shim have access to login credentials entered by user on a web page?
If Javascript has found it's way into the context of the page that you're looking at, it generally will be very straightforward for it to intercept form submissions or grab the value of input fields you type in. It's a reason you should be wary when installing browser extensions and giving them access to "All sites" or "All site data".
