New Exploit Uses JavaScript To Compromise Intranets, VPNs

redsoxh8r writes "Security researcher Robert Hansen, known as Rsnake, has developed a new class of attack that abuses a weakness in many corporate intranets and most browsers to compromise remote machines with persistent JavaScript backdoors. Threatpost reports: 'The attacks rely on the long-term caching policies of some browsers and take advantage of the collisions that can occur when two different networks use the same non-routable IP address space, which happens fairly often because the amount of address space is quite small. The bottom line is that even a moderately skilled attacker has the ability to compromise remote machines without the use of any vulnerability or weakness in the client software.'"

Comments

IPv6?

[Facegarden]

Knowing basically nothing about anything involved, i see address space limitations are a partial issue here - does that mean some use of IPv6 would help somewhere somehow?
-Taylor

Re:Network 10 has more than 1280 addresses.

[prockcore]

While we're clearing up misconceptions, the 127.x.x.x network is an entire class A loopback.

That means 127.44.55.66 is identical to 127.0.0.1