The security freaks at Watchfire recently released an amazing piece of research against Google Desktop. If you use this product it's best to update it now.
PDF and an awesome Adobe Flash presentation are worth checking out.
Essentially through Cross-site Scripting and a Javascript command and control API they've shown the ability to fully compromise a device. All of it can be automated.
As a web user I've been afraid of client-side language interpreters for a long time. Javascript, ActiveX, Java, etc -- they take too much control away from my PC and give it to web servers. Blogs, forums, malicious trojan servers, etc all can carry dangerous payloads that will run unnoticed to me because that's how the user experience is.
This year is going to be fun. :)
Wednesday, February 21, 2007
Friday, February 02, 2007
Owning a lot of football fans
This morning I awoke to find an urgent posting from Websense. Somebody had placed a bit of javascript on the Dolphin Stadium website @ http://www.dolphinstadium.com/. Don't worry, it's not there anymore. This weekend is the Superbowl and a LOT of football could very well visit this site and if they haven't updated their Internet Explorer in a while they'd find a keylogger and backdoor installed on their PC.
A pretty big issue that was resolved fairly quickly by the host removing the offending source but our comfort level with that site is shaky now. How did the attackers get in, did they close the hole or just put some silly putty over it? We may never know.
The malicious code turns out to be a javascript file called 3.js loaded from a website named dv521.com. A very quick googledork search found something interesting:
The CDC's podcast site! They've since brought down their system for repairs.
The dv521.com site has been removed as well but how many people already had their machines trojaned?
This attack is called "Persistent Cross Site Scripting (XSS)." in that the malicious JavaScript code gets left behind on the web application, usually as a database entry that is displayed at some point during the user's experience. When a somebody goes to visit the website the malicious code is loaded and, in this particular case, bad things happen to the browser if it hasn't been patched against two recent Microsoft bugs (MS06-014 and MS07-004).
There are a lot of XSS bugs out there. Michael Sutton did a massive check and reliably confirmed that out of 272 sites, 47 (17.3%) of them had a XSS vulnerability. The XSS Wall of Shame at the sla.ckers.org forum never stops, most of them being non-persistent.
Browsing the web with a JavaScript-enabled browser is just plain dangerous. It's not just those 'seedy' underground sites you should avoid, it's everywhere.
Some very good resources on XSS and its very real threats:
A pretty big issue that was resolved fairly quickly by the host removing the offending source but our comfort level with that site is shaky now. How did the attackers get in, did they close the hole or just put some silly putty over it? We may never know.
The malicious code turns out to be a javascript file called 3.js loaded from a website named dv521.com. A very quick googledork search found something interesting:
The CDC's podcast site! They've since brought down their system for repairs.
The dv521.com site has been removed as well but how many people already had their machines trojaned?
This attack is called "Persistent Cross Site Scripting (XSS)." in that the malicious JavaScript code gets left behind on the web application, usually as a database entry that is displayed at some point during the user's experience. When a somebody goes to visit the website the malicious code is loaded and, in this particular case, bad things happen to the browser if it hasn't been patched against two recent Microsoft bugs (MS06-014 and MS07-004).
There are a lot of XSS bugs out there. Michael Sutton did a massive check and reliably confirmed that out of 272 sites, 47 (17.3%) of them had a XSS vulnerability. The XSS Wall of Shame at the sla.ckers.org forum never stops, most of them being non-persistent.
Browsing the web with a JavaScript-enabled browser is just plain dangerous. It's not just those 'seedy' underground sites you should avoid, it's everywhere.
Some very good resources on XSS and its very real threats:
Subscribe to:
Posts (Atom)