[ insider_reports_insider ]
Firewall Fright Tops 2006 Hacks
David Utter
Staff Writer
2007-01-03
 Insider Reports RSS Feed
Amid a year of worms, cracks, phishes, and other computer security nastiness, a method of port scanning intranets from the outside topped the list.
 | | Firewall Fright Tops 2006 Hacks |  |
As someone who used to spend a bit of time working with a very good firewall that is now owned by a major computer security company, the first hit on WhiteHat Security CTO Jeremiah Grossman's list of top 10 hacks last year made me glad my work now involves writing about these threats instead of fighting them.
Grossman and T.C. Niedzialkowski gave a presentation at Black Hat 2006 in Las Vegas about using JavaScript as malware to hack intranet websites. It expanded on the work done by security researcher RSnake at the ha.ckers.org website to deliver a real head-turner of an attack.
Code examples crafted by Grossman and company for the demonstration do not use any web browser vulnerabilities, whether patched or unknown according to Grossman's presentation notes.
"The code uses clever and sophisticated JavaScript, Cascading Style-Sheet (CSS), and Java Applet programming," he wrote, "technology that is common to all popular web browsers."
Once a person inside a corporate firewall visits the wrong website or clicks the wrong link, the exploit goes to work searching for listening servers. Then the code makes an effort to access those servers with default logins that a careless administrator may have left in place on those devices.
Grossman noted that once the browser closes, little of the exploit code remains behind. This is why cross-site scripting problems are such a big deal, because one of them could lead to an exploit like the one Grossman described.
A workaround for the threat would mean turning off JavaScript, which would mean turning off the functionality of hundreds of websites. Even that would not be a guaranteed method of protection. You see, there's an HTML-only version of this exploit too.
Have a nice day.
---
Tags: JavaScript, XSS
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
