Slashdot Mirror
JavaScript Malware Open The Door to the Intranet
An anonymous reader writes "C|Net is reporting that JavaScript malware is opening the door for hackers to attack internal networks. During the Black Hat Briefings conference Jeremiah Grossman (CTO, WhiteHat Security) '...will be showing off how to get the internal IP address, how to scan internal networks, how to fingerprint and how to enter DSL routers ... As we're attacking the intranet using the browser, we're taking complete control over the browser.' According the the article, the presence of cross-site scripting vulnerabilities (XSS) dramatically increase the possible damage that can be caused. The issue also not which-browser-is-more-secure, as all major browsers are equally at risk. Grossman says 'The users really are at the mercy of the Web sites they visit. Users could turn off JavaScript, which really isn't a solution because so many Web sites rely on it.'"
Caveman Zonk edit headline bad.
It's not offtopic, dumbass. It's orthogonal.
Why can't users just install Firefox and NoScript extension for it. Then Javascript will be disabled by default, but user can whitelist the sites where Javascript should be enabled. Problem solved.
Giving JavaScript the power to do random network accesses may make AJAX possible, but code running in my browser has no business accessing my local intranet. For that matter, I'm uncomfortable with JavaScript applications 'phoning home' without my knowledge.
So, the fix is to treat all attempts by JavaScript in a browser as 'hostile until proven otherwise', and to ask for user confirmation when such attempts happen. Put a firewall around the browser and treat any code running in it as dangerous by default.
I predict 2 weeks before there's a FireFox update for this, and 2 years before MSIE fixes the problem.
My blog
It's not just javascript, flash content, activeX and java applets should all be disabled site-wide. Any network admin that leaves js enabled in browsers (acrobat reader etc) should probably seek employment in some other field. Anything less is irresponsible!
For about a year now I routinely install a whitelisting firefox extension called NoScript
It blocks javascript per-site until I choose to whitelist the site: Not only do I get a great deal fewer annoyances interrupting my browsing, but it also cuts out a lot of web advertising (the AdBlock extension makes my browser drag when fully loaded with filters)
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
Me, Grimlock, like headline. No want it change.
"I think so, Brain, but 'instant karma' always gets so lumpy." - Pinky
"Decepticons FOREVER!!!" - Ravage
"Then Javascript will be disabled by default, but user can whitelist the sites where Javascript should be enabled. Problem solved.
The consequences of disabling Javascript can lead to a host of new problems. I used to disable javascript and enable it by whitelist. Then I registered a piece of shareware, paid by credit card, and waited. Of course since the whitelisted servers forwarded off to some other entity which provided the registration pages, it never came back. So I figured out the servers that it was dealing with, whitelisted them, and reregistered.
Naturally I got double-billed. The shareware provider kindly fixed that situation, and I was credited, but this situation was a good example of why whitelisting sites is not the solution.
This is slightly off-topic, but it's kind of relevent to the solution of turning javascript off. Can anyone explain to me why javascript is required in Firefox to open a .wmv file (in windows, obviously)? And more importantly, what bug makes Firefox crash about 33% of the time when visiting a site that has one on it when javascript is disabled? What are the odds that bug is overflow exploitable?
Except that, you know, maybe they want to actually use JavaScript apps on their intranet?
I have been asking for years why we can't disable javascript for all but trusted sites (in phoenix/firefox/etc) via a config facility.. The default when browsing should be OFF.
Websites need to stop using javascript for conveying simple information. That Flash crap too. Most people just laugh when I say javascript is a security hole.
And it found some, but not all the web-enabled devices on my network. It found my web server and correctly identified it as Apache, found the squid proxy running on the gateway/firewall machine (identified as "unknown"), but failed to find my wireless router (through which it had to pass in order to see the rest of my network), or my print server. It also identified as "exists" several IP addresses on which no machine or device exists.
But the Firefox "NoScript" extension completely blocked it until I told it to temporarily allow the host site.
So in response to a post saying a particular technology has security holes, the consensus "solution" is not to use that technology?
That seems weak to me. By all means propose replacement solutions that do the same job, but by saying "don't use it" all you're really doing is saying "I personally have little use for it".
Sysadmins should all disable Javascript?! Fine, go ahead, I'll move to a company with less demanding security requirements. You'll find your network's impressively secure once there are no users left.
Yes it is. Users could also politely point out to the authors and administrators of the majority of web sites which rely on javascript that they really, absolutely, positively don't need it. You don't need javascript to open a link to another page. You don't need javascript to open an image in a gallery. You don't need javascript to submit a username and password. You just don't need it. I would say that using scripted actions for that is lazy and stupid, but it actually involves a good deal more work than using proper HTML. That makes it just plain stupid.
For the rare applications which actually require javascript and don't just use it as some kind of prostetic weiner replacement there is always the option of enabling scripting on a site by site basis. Turning scripting on for http://trusted.internal.site.on.your.local.net/ but not for http://random.russian.warez.and.porn.site/ really is a solution.
If you're at a site that you need Javascript to run, the little icon down in the lower right hand corner will have a pop-up menu to enable Javascript for that site you're on. You can have it enabled just for that session or permanently.
You just described a whitelist.
His TRANSACTION was sent off elsewhere, to another site, and because THAT site hadn't been whitelisted, he didn't get an acknowlegement that his payment had been accepted.
I know you no-script fanboys can't stand the idea that your favorite tool might not be perfect for everyone, everywhere, all the time, but learn to read before spewing your fanboy-ism.
Ah, the simpler days of gray backgrounds and Times New Roman. None of these fancy tables, neither. And we had to walk 5 miles to school, uphill, in snow up to our hips. And 10 miles uphill to get back home. Kids today with their fancy JavaScript. No appreciation, none at all.
Do you have a flag?
How anyone can just not use a simple extension to block scripts, flash, java, etc like the Firefox NoScript extension is just confusing to me. People actually seem to want to run foreign applications on their system through sites which can quite easily load anything they want.
Make it clear to your family that the modern Internet is like the real world. Protecting your computer with either a secure Internet Explorer (eg: the default Windows 2003 IE config) or Mozilla Firefox (with the NoScript and CookieSafe) configuration is like leaving your car unlocked in a inner-suburb train station... It will get broken into!
For those affected by these issues: welcome to the real world. Grow up, plug in, learn what the hell your doing on this internet.
You should need a licence to even have an Internet Connection.
The answer with all these technologies is to get away from the "everything is permitted, everything links to everything else" model that Microsoft promoted till it ran into trouble, and work out a way of implementing security policies that are comprehensible and that work.
Pining for the fjords
It also blocks the attribute, something which won't be introduced until Firefox 2 and for which it's possible to set a pref in about:config. Also, it doubles as an egg timer!
Seriously, NoScript is great, but if I want to block flash I'll install Adblock or Flashblock. If I want to whitelist sites for javascript then I'll use NoScript. Whatever happened to the concept of simply doing one thing well?
The vast, vast majority of exploits involve JavaScript in one way or another. If it were possible to just "turn off" JavaScript world-wide overnight, the number of exploits would drop down substantially. Of course you would still have the "stupid user" problem, but you can only do so much to combat that.
As far as browsers are concerned, a large percentage of exploits are being written by / for criminal elements for profit. To this end, they maximize their profit potential by targeting the most prolific browser. For now, FireFox and others are relatively safe. We have seen a few things come out lately, but they are really just toys compared to what is out there for Internet Explorer. These people writing the exploits are, unfortunately, rather smart and clever. When it becomes econically feasible for them to target FireFox / Mozilla / whatever, make no mistake about it: they will. That is when we will see how secure that software really is.
This is where people bring up the IIS vs Apache argument. My only answer to that is that there is little money to be made in compromising web servers. There are a few cases of corporate espoionage, but most of the time it is ego-driven: defacement, spreading worms, etc. A competent webadmin will eventually discover the breach and fix the system, so there is not a long window of opportunity. Compromising millions of home users' PCs without them even knowing it is much better profit-wise; you can spam the shit out of anything pretty much with impunity, and people will pay you good money to do it. So these kinds of people target what they are familiar with: Microsoft. I think compatibility also plays a role. Any Windows server running IIS can run any Windows binary. This is patently untrue of Linux servers running Apache; there are so many different combinations of distributions, libraries, and architectures that binary compatibility is very small if it even exists. Microsoft is an easy target because it is such a monoculture.
Your grammar frightens and confuses me.
It's not offtopic, dumbass. It's orthogonal.
You don't need javascript to open a link to another page. You don't need javascript to open an image in a gallery. You don't need javascript to submit a username and password. You just don't need it.
You don't need it - you want it. You want it to make the entire web experience better.
From a security standpoint, everyone should be on lynx or similar browser. From the user standpoint, Javascript is essential (see maps.google.com, or gmail) for a good web experience. Images are fundamental. Web is not static HTML any more. We now live in the world of DHTML and security is just going to have to deal with it.
Javascript is broken if it allows you to access other than non-remote resources (ie. from original website) and some settings available to it from the browser (windows size, etc..). That's what it is there for and other uses should be disabled. We already see it with the JS popup blockers. Similar security for network accesses should suffice.
Similarly with Java, Flash and other things.
Comment removed based on user account deletion
And for your intranet server, that *IS* likely to need scripting, ex: an internal wiki, or bulletin board that uses one of the fancy html editors?
Michael J. Ryan - tracker1.info