Slashdot Mirror
Alarm Raised For "Clickjacking" Browser Exploit
Shipment Date writes "ZDNet's Zero Day blog has some new information on what looks like a scary new browser exploit/threat affecting all the major desktop platforms — Microsoft Internet Explorer, Mozilla Firefox, Apple Safari, Opera and Adobe Flash. The threat, called Clickjacking, was to be discussed at the OWASP conference but was nixed at the last minute at hte request of affected vendors. From the article: 'In a nutshell, it's when you visit a malicious website and the attacker is able to take control of the links that your browser visits. The problem affects all of the different browsers except something like lynx. The issue has nothing to do with JavaScript so turning JavaScript off in your browser will not help you.'"
*crickets*
I knew there was a reason I liked lynx
i have a roll of electrical tape.
was some weird mouse-mastubation scenario. *shudders*
Well, they can't steals clicks from a browser without clicks
Religion: The greatest weapon of mass destruction of all time
You call this "information"? It's not even clear what the exploit is about.
Oh great. Expect a resurgence in rickrolls. No one can protect you!
Fairly certain this is one of the listed fixes for 3.0.2, but I could be wrong (Or is this _another_ kind of clickjacking flaw?)
Isn't that what happens *after* you visit a pr0n site?
The issue has nothing to do with JavaScript so turning JavaScript off in your browser will not help you.'
The quote from the article says you can protect yourself by disabling scripting:
In the meantime, the only fix is to disable browser scripting and plugins. We realize this doesnâ(TM)t give people much technical detail to go on, but itâ(TM)s the best we can do right now.
Fnord.
Finally I have a legitimate excuse for all the pr0n sites that are in my browser history. No honey, it isn't me, it's a browsers exploit! I swear!
I don't think this exploit really exists. A cross browser cross platform exploit that doesn't use javascript?
Won't be losing any sleep over this one.
Anybody know if/how Konqueror is affected by this??
I didn't find that information in TFA or in any of the TFAs linked in TFA (here here here here). Though it may be so; it sounds like this exploit makes use of the browser's access to the clipboard.
Elinks FTW!
Caveat Utilitor
From reading TFA (I know, silly me) this seems to be pretty much fear-mongering with a fancy new buzzword. "Clickjacking" oooo scary!
Until some real technical details come up I'd say nothing to see here, move along.
Well, add OWASP to the list of security organizations with no integrity. It's clear they care about their sponsors, not their members.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
FTA: "The issue has nothing to do with JavaScript...", "Javascript is not required to exploit this....", "The exploit requires DHTML." Anyone care to educate me on these seemingly contradictory statements? (and yes, I know DHTML could utilize a different, non-JS scripting language). What else is DHTML but HTML, scripts that run in the browser's scripting engine, and CSS?
So how does it work now?
Lynx is safe, but all other's are not. But disabling Javascript doesn't help?
Then there is
"In the meantime, the only fix is to disable browser scripting and plugins"
So what exactly does "browser scripting" mean, if not Javascript?
i didn't even click on this story; someone must want me to read this...
Web browser, Web browser, Web browser, Web browser, and cross-platform method for running code delivered from untrusted sources.
From TFA:
One vendor is, unlike the others, mentioned by name. It happens to be the vendor that ships The One Thing That Is Not Like The Others.
Also from TFA:
and
"In the meantime, the only fix is to disable browser scripting and plugins. We realize this doesn't give people much technical detail to go on, but itâ(TM)s the best we can do right now."
Now we're at a quandary. Your humble correspondent is at a loss to even speculate as to the nature of a technology that Ffirstly isn't Javashit, but which can conceivably be invoked by web content regardless of which web browser is in use, but lastly can be secured against by disabling hated plug-ins.
There was this slashdot article here.
Turns out some hacker clickjacked the link, replacing it with a useless link with no detail or value added. It is getting more and more common on slashdot.
p0rn mode
This could be totally unrelated to this exploit but I devised a way to do something like this in the past where I'd use javascript to check whether a link on a page has been visited by the user or not based on what color it was. Given a huge list of websites, you could weed out what sites a user has visited and what sites they haven't by dynamically adding them to the page, then looping through the links using javascript. It could then potentially be written to a log file with the users IP.
"During My Service In The United States Congress, I Took The Initiative In Creating The Internet." -Al Gore
Using the links browser in a terminal with mouse support is almost exactly like using a browser with images turned off...
Witness:
http://www.jikos.cz/~mikulas/links/screenshots/png.html
ok - i read TFA, scanned all the links blogs, their trackbacks and comments and from what i've seen there is no real info on what this is. Thinking about it for 2 minutes I had this idea that this will be best chance ever to get rid of IE6. My hope is that all the browser vendors (including MS) have conspired that maybe 3 weeks of making scary "clickjacking" news and pushing them to the main media outlets will eventually raise awareness to let go of that horrible thing that's keeping the web from really evolving. finally a good excuse to disable your content for outdated browsers that aren't patched any more because the user might accidently the whole clickjack. But in the end - if the download links don't get clickjacked that is - MS will propably release some stupid patch that prevents IE6 from clickjacking alltogether and it will be 3 more years before IE6 leaves for good....
I'm expecting this gem to be the next Rickroll. Thanks MST3K. :)
I'm trying to think of the ways this could be used to cause harm, so far the biggest threat I see is to the pay-per-click ad model, since this would be great for clickfraud. Other than that, a website could bounce you to another page on their site that you didn't intend to go to, and possibly overwhelm your browser & bandwidth with a redirect loop. I can see a hint of an issue in the way frames might be used with this exploit and 3rd-party sites (as noted in the article), but that seems to be a bit of a stretch since the original site would still be sending someone away from their site in another redirect. Plenty of sites who make the choice to be annoying already make you go through a little effort to break out of their frames when you go to an external site from one of their links, it's not the end of the world.
I'd like to hear other folks' ideas on ways this may be used for an exploit that could do damage to anything other than Google's bottom-line. Until I hear a more compelling one, this exploit doesn't strike me as being the least bit "scary". A "small potential nuisance" might be a more apt description, since it would be fairly simple for end users to just ignore its effects.
Details at 11.
Ever almost accidentally click on an AD that had popped up just as you were going to click on a link?
If it hijacks clicks IN browser, you just use alt-f4 to close it down, most people won't even have loaded the page by then. I don't understand how this is worse than malicious redirects. And since most websites people rely on use flash/scripts, I don't see the use in cutting scripts off.
That doesn't work. I didn't click and I don't feel either way about not clicking. Meh.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
The coverage here sounds overhyped. Hype aside, the true nature of the problem is that software vendors are not held accountable to defects in their products (by drafting EULAs that basically negate any responsiblity to any such defect).
We'd have less exploits if vendors, such as M$, were held liable to any damage incurred by their customers.
The exploit was first discovered at about 7:30 am after blogger Ryan Naraine's boss noted several "odd" adult sites appeared in mister Nariane's browser history.
So far, the exploit seems confined to browsers on Mr. Nariane's desktop, so users of effected browsers are urged to apply all public OS/browser patches and to stay away from Ryan's desktop.
Is crome affected? ;-)
I've seen situations that otherwise look like benign layout bugs, where two or more hyperlinks or other clickable objects end up being overlayed on each other. It's not clear which one would be activated until you click. If someone intentionally did this AND obscured the object they wanted the victim to click, and made the other object more attractive, people might be doing such clicking. This could be easily done with CSS on one page, but there's not advantage since both links are just part of the same page. I don't think frames would do this. However, IFRAMES might do this on a cross "page" basis. The perp makes an attractive link that overlays over an iframe that is loaded from another page, so the act of clicking gets the victim to effective click on the other page. This loads something else in the iframe, but from the perpective of that other web site, it was a click on their page (based on the referer value). The simple exploit would get people to click on an ad, and it would not be visible to the ad vendor which page was doing the exploit.
now we need to go OSS in diesel cars
From google cache:
Clickjacking
Thereâ(TM)s been a bit of drama over the last week or so around the upcoming world OWASP conference in New York. Itâ(TM)s surrounding a talk that Jeremiah and I were planning on doing the first day of the conference. Jeremiah and I have been working on some interesting browser security issues which also effect a lot of downstream people/websites/technologies as well. Sounds like a good talk right? We thought so too!
Alas, it turns out that some of the issues we found werenâ(TM)t just a little bad - they were a lot bad. So bad, in fact, that we felt compelled to do some responsible disclosure. One issue lead into another issue into another and poof - we have at least two and probably more incoming vendor patches at a yet to-be-determined date. And weâ(TM)ve only worked with a few vendors. So⦠yah. Itâ(TM)s pretty bad.
As you may have guessed the first is a browser company, Microsoft (to be expected since itâ(TM)s a browser issue to begin with). The second is Adobe - who have been working closely with us on this one since we first told them about the problem. We have been working on proof of concept code since before Blackhat and finally got our ducks in a row with real working exploit code a few weeks ago. And that is pretty much when the problems started. None of the issues we found relating to the browser were particularly easy to fix, it turns out.
The related issues we found that affect websites (instead of browsers) is thankfully slightly easier to deal with on a one off basis, but that too is going to be a problem. There are a lot of much easier hacks out there against websites for sure, but what weâ(TM)ve been working on breaks some previously good security measures. The correct solve will not be patching every web-site on earth. Instead it will likely end up being a browser patch against every major browser. The idea of every webmaster in the world patching their own sites is a non-starter. Although Iâ(TM)m sure lots of people are going to run out and patch their sites rather than wait for the normal browser patch and release cycle for all browsers everywhere. Weâ(TM)ve discussed the high level concern with both Microsoft and Mozilla and they concur independently that this is a tough problem with no easy solve in sight at the moment.
So, after much deliberation we opted to pull our speech voluntarily, due to the extremely neutered information weâ(TM)d have to be sharing. Weâ(TM)d much rather share the full breadth of what we found when it can be discussed more openly as to not diminish the danger of the flaw by only talking about small parts of the issue. There will still be holes in many websites due to this problem even after the short term patches are available, but weâ(TM)d rather a few of the more critical problems get patched before we go public.
However, I must stress, this is not an evil âoethe man is trying to keep us hackers downâ situation, a la Michael Lynn vs. Cisco, or Chris Paget vs. HID, or MIT vs. MBTA and so on. We proactively decided it was better to pull the speech ourselves for the time being and for anyone who was looking forward to the speech all I can say is I hope to make it up to you once the vendors are in a better spot. It wasnâ(TM)t an easy decision but it really feels like the best option we have given the current situation. If youâ(TM)re desperate for a way to patch your browser from the issue disable scripting and plugins for the time being. More to come.
This entry was posted on Monday, September 15th, 2008 at 5:36 pm and is filed under Webappsec. You can leave a response as well.
And from the Adobe report:
Thanks to Jeremiah Grossman and Robert "RSnake" Hansen
Robert âoeRSnakeâ Hansen and Jeremiah Grossman recently shared with us some information they were planning to include in an upcoming presentation at the OWASP NYC AppSec confer
...the lack of Flash support in Mobile Safari is now a security feature!
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
In its most primitive form, it basically involves taking an iframe, figuring out where the link part/form part is, and then tricking the user into clicking it.
This seems very clunky and hacky, but I suspect that the speakers at the OWASP talk have gotten this technique to work well enough so that it is both transparent and highly effective. Can you think of a website that needs you to click, say, a play button in order to view content? That click may be hijacked through an invisible iframe to execute an action on another website.
The good folks at Google recently raised this topic on the WHATWG mailing list, you can read more about it here: http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2008-September/016284.html
I'm still using Gopher, so I'm getting a big kick out of the misfortune of all you high and mighty "web browser" people.
Comment removed based on user account deletion
OK after RTFAing and reading others comments, isn't this something that can be patched by the Adoobie company? In the meantime I set my faithful Fruitfucker 2000 robot on Extreme Vigilant Flash Plugin Fuxx0ring setting.
I will not be pushed, filed, stamped, indexed, briefed, debriefed or numbered. My life is my own.
"In the meantime, the only fix is to disable browser scripting and plugins. We realize this doesn't give people much technical detail to go on, but it's the best we can do right now. "
What's one malicious/annoying script from another? I turned them all off, years ago, and magically problems with trojans, annoying popups, and flashy/dodgy adverts all went away.
At work, I put CNN on my restricted sites list to explicitly prohibit the site from running scripts. I'll take my biased news without the long page loads to pay your sponsors, thanks.
Glad to hear that I patched out this zero day exploit well over 700 days ago.
You can get 15 minutes of fame, but you can go down in history for infamy.
From a comment on TFA:
Question everything
After reading AKAImBatman's comment, I realized it's not a DOM/scripting vulnerability, but just the ability to hide a link behind flash or an animated GIF content.
Kudos to AKAImBatman for understanding what this was about - and Kudos to the hackers for both discovering such an ingenious exploit and for working with the companies to fix it.
Is that a crisp, clean Adobe lager with a nice finish?
You can't talk about Wikipedia's flaws on Wikipedia
I have JavaScript disabled. Does that still count as being Rickrolled?
AFAIK the only way to disable CSS is to use obsolete browses like lynx.
I may be wrong here but in FF doesn't View >> Page style >> No style disable CSS? IANAWD
Reply to That ||
I recommend immediately that $700B be transferred to the browser companies to fix this problem. Furthermore, we must transfer this money by end of the week with no strings attached.
Something Witty Goes Here
That's Google's first browser :-)
http://googlesystem.blogspot.com/2006/03/google-browser.html
iFrames, ActiveX, Browser-as-a-desktop, external-facing daemons for internal systems... anything that isn't buggy that comes from them?
Use object tags and use HTML or XHTML Strict people and it won't happen to you.
Custom electronics and digital signage for your business: www.evcircuits.com
the days when the internet was "stateless" and CGI's where in C? :)
"I don't think this exploit really exists. A cross browser cross platform exploit that doesn't use javascript?
Won't be losing any sleep over this one." - by sakdoctor (1087155) on Thursday September 25, @04:26PM (#25156779) Homepage
Well... IFrames, &/or Plugins (specifically Adobe Flash is my guess here) are what you need to worry about!
(Though, supposedly from what I have been reading? Turning off javascript does NOT hurt, & does actually help (despite the last line of the init. post here)).
Here is about as "close to the truth" as you'll get, due to "responsible disclosure" (rather than FULL disclosure... so, go to the guys that 'discovered it'):
http://jeremiahgrossman.blogspot.com/2008/09/cancelled-clickjacking-owasp-appsec.html
APK
P.S.=> I've been telling folks to 'crank those off' (plugins &/or IFrames, as well as javascript (if you do NOT absolutely NEED IT, for proper page functionality (such as on online banking &/or shopping sites))), here, for more than a year now:
HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, plus, make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?s=67b2240128d853305689dd2c383066e8&showtopic=2662&st=0&start=0#
apk
From the first time they were invented there was some people with outspoken criticism on frames. Frames have been one of the worst security problems of the web from the start. Now we will see more and more exploits that take advantage of having content from multiple websites. And I'm not even talking about the privacy problems with frames and other cross site content.
The best and maybe only solution is not to allow multiple servers to deliver content to the same page. If multiple servers are really needed, one could think of only allowing one host (i.e. www.host.com) and hosts ending with the same name (i.e. images1.www.host.com).
As long as we keep seeing cross site content, it will be a nightmare to manage the security, especially since the functionality of the browsers will keep increasing (and therefore the number of attack vectors).
Well... IFrames, &/or Plugins (specifically Adobe Flash is my guess here) ARE what you need to worry about!
(Though, supposedly from what I have been reading? Turning off javascript does NOT hurt, & does actually help (despite the last line of the init. post here)).
Here is about as "close to the truth" as you'll get, due to "responsible disclosure" (rather than FULL disclosure... so, go to the guys that 'discovered it'):
http://jeremiahgrossman.blogspot.com/2008/09/cancelled-clickjacking-owasp-appsec.html
(Just "2nd'ing your motion", to go to the "horses mouth")...
APK
P.S.=> I've been telling folks to 'crank those off' (plugins &/or IFrames, as well as javascript (if you do NOT absolutely NEED IT, for proper page functionality (such as on online banking &/or shopping sites))), here, for more than a year now:
HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, plus, make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?s=67b2240128d853305689dd2c383066e8&showtopic=2662&st=0&start=0#
apk
Except for blind people that rely on the (absence of any) layout in lynx, lynx has been superseded by w3m. Tables, frames, Unicode, and imagedisplay when $DISPLAY is available. (And no, don't suggest elinks because it can't do the latter two.)
I tried the link and I'm not affected. really! I have no plugins!
This is slashdot. People here aren't supposed to know what that means..
Obviously, there's one key difference: in CSRF, the malicious activity is POSTed from a remote page. In a "clickjacking" attack, the malicious activity is POSTed actually using your own page (embedded in a remote page).
Other than that, it's largely the same basic idea -- you trick someone into submitting an action to a remote site using their pre-existing credentials.
The question is, is it possible to employ any well known CSRF prevention techniques to "clickjacking"?
But could you not have a plugin/filter that would look for IFRAME src strings that != *.currentdomain.com? I'm sure there's more of a pattern or signature here that could be parsed/matched (i.e. whatever the offending CSS would be and if it applies to said IFRAME element).
Certainly there's legitimate uses for hidden IFRAMES that point to other domains -- and I'm grossly generalizing here in my example -- but if we can accept heuristic analysis as the de facto standard for telling us whether our email is spam or not, surely there's enough incriminating evidence available to create an effective rule against exploits such as Clickjacking?
body massage!
"... javascript is not required to exploit this."
"The exploit requires DHTML."
I thought DHTML was, by definition, the use of Javascript to manipulate the HTML of a web page. So, how can something require DHTML, but not Javascript?
... not to RTFA.
Tomato wedge sperm darts that are Republican.
it can't do the latter two.
Unicode, maybe. But images? Click on "Google" alt text on www.google.com in debian's elinks (0.11.1) and you get
Its default option is pulled from /etc/mailcap and friends (debian, with imagemagick installed: image/gif; display 'gif:%s'; test=test -n "$DISPLAY")
If I have been able to see further than others, it is because I bought a pair of binoculars.
iFrames are evil!
All they are used for is Adverts & Hackers.
I block iFrames in Opera 8)
How to ban them simple the next update of all Browsers would disable them where the could not be turned back on! This would force the Web Dev Guys like to fix your site ;)
While I'm at it Google is SpyWare they use iFrames also!
Unfortunatelly, I'm a mere mortal.. :(
https://bugzilla.mozilla.org/show_bug.cgi?id=457011
I'd worry about this but I've locked my self in the closet in order to be safe from killer bees and I can't be arsed.
I RTFA, and the only things I learned are that:
1. It's very bad;
2. They can 'make me click anywhere on the page'
3. It's very bad.
-- Cheers!
Java script and vbscript are easy enough to deal with... Why not uninstall/disable flash... It is a neat technology but rarely used in a productive manner. Before ya start flaming me, do a rough count of all the ads, innocuous videos, poorly designed games and websites, and any other useless/nefarious/wasteful implementation you can think of... Compare that to, say, the number of all helpful, intelligent, productive, and generally useful/fun implementations you can think of. As for me the math is relatively easy.
So little detail! :( Iframes is what I suspect what it is:
http://sk89q.therisenrealm.com/2008/09/clickjacking/
If you're still pondering.
iframes? who needs that anyway.
Ok, forgive my ignorance, but what exactly is the problem here? It sounds like they can redirect my click, getting my browser to visit another page. Apart from being a slight nuisance, how is that going to cause a problem?
Surely it's only going to be an issue if you are also vulnerable to something else that allows the target site to install malicious software on your machine, and people being vulnerable to stuff like that isn't exactly news.
I mean, if I've already locked down javascript, plugins, active scripting, etc in IE (or just noscript in Firefox), surely the absolute worst this can do is redirect me to a site that try as it might, still can't infect my pc?
The summary and article sound like the sky is falling, but unless I've misunderstood, I don't even think I need to react to this. Sure, it'll be mildly irritating if I visit an affected site, but I'm already protected from anything worse.
So far it's getting a "-1 Meh" from me.
This seems very clunky and hacky, but I suspect that the speakers at the OWASP talk have gotten this technique to work well enough so that it is both transparent and highly effective. Can you think of a website that needs you to click, say, a play button in order to view content? That click may be hijacked through an invisible iframe to execute an action on another website.
So, how is this essentially different from CVE-2004-0762, fixed in Firefox four years ago? Okay, they might have found new attack scenarios, but the technique seems to be rather old.
OS Reviews: Free and Open Source Software
People... they are talking about Myspace. Apparently most modern browsers are vulnerable to Myspace.
Sorry,
I checked this and everything looks really ugly.
Can we get an OffByTwo browser that can sneak past the exploit but not look quite so awful?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Ender's Game FTW!
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
No.
It causes you to perform actions on the football player's girlfriend you didn't think you were performing!
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
SB: Clicking on the Icky Sticky Clicky Wiki's...
SB: "Dear StrongBad. This website says that if I click on a link I could get my browser taken over!! What do I do? P.S. I want the Tire."
SB: Easy IWTT. Click Here to open a nice juicy SubPrime Mortage on that tire. https://www.wamu.com/personal/default.asp
SB: Gotcha! That's Washington Mutual! They got hosed so The Government said, "You have no chance to survive make your time." JP Morgan stepped in and said "All Your Mortgage Are Belong To Us."
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Mod Parent Troll.
You're handed a juicy exploit that gives you nice little clicks and can't think of a way to break it?!
Here is the Least severe example I can think of. You click to look up something at work and it sends P0rn to HR.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Carnegie Hall "milk and cookies" Show:
In an April 1979 performance at New York's Carnegie Hall, ...
The performance is most famous for Kaufman ending the show by actually taking the entire audience, in 20 buses, out for milk and cookies.
http://en.wikipedia.org/wiki/Andy_Kaufman
Now... do you trust me to give you an honest link?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
No need, NoScript blocks most of these attacks, according to a follow up post.
Actually, you thought it was his girlfriend... but it was actually him.
in TFA it says Noscript doesnt stop the problem 100% - but there is a link to a page that says that only applies in noscript's default setup. You can get it to stop this problem completely.
http://blogs.zdnet.com/security/?p=1973
noscript -> options -> plugins -> forbid IFRAME.
should be helpful till someone comes up with a proper solution.
(1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
how about something that disables (i)frames?
So a malicious website can get you to click on a link or button of another website. Could someone explain to me how this could be used to do anything other than inconvenience the user - "ha ha loser, you thought you were clicking on that free porn button but i just made you click on the Delete All Email button". As for a solution, couldn't users install something like Stylish (https://addons.mozilla.org/en-US/firefox/addon/2108) and add a rule to put a bright red border around all IFRAMEs?
Actually, more like you click on something at work, you come across an unsavory site, it tries to load pr0n popups on you, the corporate web-nanny blocks them all, you get called into HR to explain the situation. The only thing is, this sort of web-cruft has been around a while. This is just a way to make it happen through real external-site clicks rather than just launching popups. A nuisance, but not a particularly scary exploit. Maybe it just takes a lot to scare me-- I'd be worried if it could perform actions on pages it brought up, but if all it does is make me follow links it wants me to visit, the worst case scenario is that I'm going to close the browser and never go to the site again...
That's just the problem - it can.
"Follow a link" can go to *anything* including custom loaded pages which then do actions...
Would bringing an FBI Raid upon your head be scary enough?
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
Looks like I was correct in my "guess" here, in the post I did here two weeks ago (where I indicated stopping plugins, specifically ADOBE FLASH PLAYER):
http://secunia.com/advisories/32163/
SALIENT QUOTE:
"A vulnerability has been reported in Adobe Flash Player, which can be exploited by malicious people to bypass certain security restrictions and disclose potentially sensitive information. The vulnerability is caused due to a design error and can be exploited to e.g. gain access to the system's camera and microphone by tricking the user into clicking Flash Player access control dialogs disguised as normal graphical elements. The vulnerability is reported in version 9.0.124.0. Other versions may also be affected. [b]Solution: The vendor recommends disabling Flash Player camera and microphone interactions[/b]"
----
It also appears that I was also correct in my "guess" here, in the post I did here two weeks ago, about stopping JavaScript also (despite the init. newspost here saying "javascript is not part of it" etc. et al):
http://www.securityfocus.com/news/11534/2
SALIENT QUOTE:
"JavaScript increases the effectiveness of this attacks hugely, because it ensures that user will click our target no matter where he points -- that is, we can move the target around to stay always under the mouse pointer,"
APK
Looks like I was correct in my "guess" here, in the post I did here two weeks ago (where I indicated stopping plugins, specifically ADOBE FLASH PLAYER), which was the reply I just replied to in THIS followup posting:
http://secunia.com/advisories/32163/
SALIENT QUOTE:
"A vulnerability has been reported in Adobe Flash Player, which can be exploited by malicious people to bypass certain security restrictions and disclose potentially sensitive information. The vulnerability is caused due to a design error and can be exploited to e.g. gain access to the system's camera and microphone by tricking the user into clicking Flash Player access control dialogs disguised as normal graphical elements. The vulnerability is reported in version 9.0.124.0. Other versions may also be affected. Solution: The vendor recommends disabling Flash Player camera and microphone interactions"
----
It also appears that I was also correct in my "guess" here, in the post I did here two weeks ago, about stopping JavaScript also (despite the init. newspost here saying "javascript is not part of it" etc. et al):
http://www.securityfocus.com/news/11534/2
SALIENT QUOTE:
"JavaScript increases the effectiveness of this attacks hugely, because it ensures that user will click our target no matter where he points -- that is, we can move the target around to stay always under the mouse pointer,"
APK
P.S.=> I've been telling folks to 'crank those off' (plugins &/or IFrames, as well as javascript (if you do NOT absolutely NEED IT, for proper page functionality (such as on online banking &/or shopping sites))), here, for more than a year now:
HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, plus, make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?s=67b2240128d853305689dd2c383066e8&showtopic=2662&st=0&start=0#
AND, as you can see? IT JUST WORKS (even vs. the "latest/greatest" security threats/hacks/vulnerabilities: Common-sense usually does work)... apk
Looks like I was correct in my "guess" here, in the post I did here two weeks ago (where I indicated stopping plugins, specifically ADOBE FLASH PLAYER), which was the reply I just replied to in THIS followup posting:
http://secunia.com/advisories/32163/
SALIENT QUOTE:
"A vulnerability has been reported in Adobe Flash Player, which can be exploited by malicious people to bypass certain security restrictions and disclose potentially sensitive information. The vulnerability is caused due to a design error and can be exploited to e.g. gain access to the system's camera and microphone by tricking the user into clicking Flash Player access control dialogs disguised as normal graphical elements. The vulnerability is reported in version 9.0.124.0. Other versions may also be affected. Solution: The vendor recommends disabling Flash Player camera and microphone interactions"
----
It also appears that I was also correct in my "guess" here, in the post I did here two weeks ago, about stopping JavaScript also (despite the init. newspost here saying "javascript is not part of it" etc. et al):
http://www.securityfocus.com/news/11534/2
SALIENT QUOTE:
"JavaScript increases the effectiveness of this attacks hugely, because it ensures that user will click our target no matter where he points -- that is, we can move the target around to stay always under the mouse pointer"
(A note to the news submitters here & the editors: Learn about this stuff, before stating things that are outright incorrect (such as the init. newspost stating turning off javascript would not help vs. this new threat... without understanding this stuff thoroughly, first? You'll end up eating your words...)
APK
P.S.=> I've been telling folks to 'crank those off' (plugins &/or IFrames, as well as javascript (if you do NOT absolutely NEED IT, for proper page functionality (such as on online banking &/or shopping sites))), here, for more than a year now:
HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA, plus, make it "fun-to-do", via CIS Tool Guidance (& beyond):
http://www.tcmagazine.com/forums/index.php?s=67b2240128d853305689dd2c383066e8&showtopic=2662&st=0&start=0#
AND, as you can see? IT JUST WORKS (even vs. the "latest/greatest" security threats/hacks/vulnerabilities? Common-sense usually does work)... apk