Nasty Javascript attack possibilities



There were demonstrations of some nasty javascript attacks at Black Hat as well (as if the wireless driver issues wasn’t a big enough problem…) Javascript is a powerful language and can be used for many things, but in these demonstrations, it was used to track recently visited sites (by the browser victim) and identify the IP address of the victim on the internal LAN AND to alter firewall settings. From the way I read the article at the Security Fix – this is changing HARDWARE firewall settings.


I don’t know details as of yet, but have to wonder if uPnP would be involved with being able to change the firewall settings. I don’t know quite how else it could easily be done to alter a hardware firewalls configuration without lucking out and the target pc being the same pc that’s used to 1)administer the firewall or 2)save the login/password…. I do understand that uPnP enabled firewalls are susceptible to quite a number of possible attacks once the attacker is “in the internal network”.

More reasons to filter/proxy traffic at the firewall to begin with?

Update –8/3/06 4PM edt–

Betanews has some posibilities on these javascript exploits being aimed at rss readers. The idea here being that the baddies could either have a feed that they insert javascript into, OR more likely insert javascript into the comments on posts on a legit site. Many sites provide rss feeds for the comments on posts. The bottom line on this is that software that pulls data from untrusted sources needs to be cautious about verifying the data. (Or for rss readers to disable advanced features like javascript?)

Related Posts

Blog Traffic Exchange Related Posts
  • Cross browser javascript vulnerability It sounds like this vulnerability would take a great deal of user interaction, but cio-today is reporting on a browser vulnerability that affects pretty much every javascript enabled browser. According to Symantec .... "This issue is triggered by utilizing JavaScript 'OnKeyDown' events to capture and duplicate keystrokes from users," and......
  • Zotob worm bites big media outlets According to several reports there are several big media outlets seeing what is reported as the zotob worm which exploits a Microsoft Windows vulnerability (MS05-039) disclosed last week. There seems to be no better way for something to make the news than for it to affect the companies that bring......
  • Firewall musings... Yesterday I had a bit of a realization. I had just been looking at a wireless router/firewall setup and was thinking about the firewalling rules (which seemed to be geared at the WIRELESS lan... i.e. blocking that activity on the Wireless segment.) You know, traditionally firewalls have had the attitude......
Blog Traffic Exchange Related Websites
  • Solidifying WP Security Designed with PHP, and powered by mySQL directories, WordPress is used by an amazing 8.5% of all websites. Web delivered spyware and web page hacking are becoming progressively more common. With such a lot of web content using WordPress as a CMS, any security weaknesses in the CMS structure or......
  • How do RSS Feeds Work? If you’re confounded by that little orange graphic you see on blogs, it’s time to learn all about RSS and how it can benefit your own blog. Most software packages and content management systems offer RSS capablility, but it’s up to you to implement it. When used properly, RSS feeds......
  • Building my Tribe: Part 1 This past weekend the girls over at SITS spoke of how to build up your blog. But the most interesting thing was was how they speak of "tribes". Tribes being a group of blogs that you yourself follow regularly, and in turn, a bunch of people/blogs that follow you regularly. So......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site