Nasty Javascript attack possibilities



There were demonstrations of some nasty javascript attacks at Black Hat as well (as if the wireless driver issues wasn’t a big enough problem…) Javascript is a powerful language and can be used for many things, but in these demonstrations, it was used to track recently visited sites (by the browser victim) and identify the IP address of the victim on the internal LAN AND to alter firewall settings. From the way I read the article at the Security Fix – this is changing HARDWARE firewall settings.


I don’t know details as of yet, but have to wonder if uPnP would be involved with being able to change the firewall settings. I don’t know quite how else it could easily be done to alter a hardware firewalls configuration without lucking out and the target pc being the same pc that’s used to 1)administer the firewall or 2)save the login/password…. I do understand that uPnP enabled firewalls are susceptible to quite a number of possible attacks once the attacker is “in the internal network”.

More reasons to filter/proxy traffic at the firewall to begin with?

Update –8/3/06 4PM edt–

Betanews has some posibilities on these javascript exploits being aimed at rss readers. The idea here being that the baddies could either have a feed that they insert javascript into, OR more likely insert javascript into the comments on posts on a legit site. Many sites provide rss feeds for the comments on posts. The bottom line on this is that software that pulls data from untrusted sources needs to be cautious about verifying the data. (Or for rss readers to disable advanced features like javascript?)

Related Posts

Blog Traffic Exchange Related Posts
  • RSS feed to spread the word of software updates The computer security landscape today is such that pretty much ALL software, whether it's Operating System, Office Suite, Web browser or device driver is at any given time "the weakest link". One of my dreams as someone that does IT is "what IF there were an easy way to keep......
  • Zotob worm bites big media outlets According to several reports there are several big media outlets seeing what is reported as the zotob worm which exploits a Microsoft Windows vulnerability (MS05-039) disclosed last week. There seems to be no better way for something to make the news than for it to affect the companies that bring......
  • Cross browser javascript vulnerability It sounds like this vulnerability would take a great deal of user interaction, but cio-today is reporting on a browser vulnerability that affects pretty much every javascript enabled browser. According to Symantec .... "This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users," and......
Blog Traffic Exchange Related Websites
  • How do RSS Feeds Work? If you’re confounded by that little orange graphic you see on blogs, it’s time to learn all about RSS and how it can benefit your own blog. Most software packages and content management systems offer RSS capablility, but it’s up to you to implement it. When used properly, RSS feeds......
  • Firewall Internet Security Firewall seems to be very popular these days. Firewall is the program that helps you to protect your digital world. There are many companies, which produce the firewall because of its tremendous demand. If you are using windows xp, there is default firewall software that you can use to furnish......
  • What is an RSS Feed and Why Syndicate Your Blog? Blog feeds or RSS feeds allow for feed readers to access a site that automatically looks for new content from all of their favorite blogs. By syndicating your blog through an RSS feed you can allow your readership to access all of your new blog posts without requiring them to......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site