Slashdot Mirror
Using HTML5 To Hide Malware
New submitter Jordan13 writes: SecurityWeek reports on the findings of a group of Italian researchers about web malware. They developed three new obfuscation techniques that can be used to obfuscate exploits like the one usually leveraged in drive-by download malware attacks. These techniques use some functionalities of the HTML5 standard, and can be leveraged through the various JavaScript-based HTML5 APIs. The research also contains recommendations about some of the steps that can be taken to counter these obfuscation techniques.
And this in an article about HTML.
Before you write articles about a subject, it'd be a good idea to actually be knowledgeable in that subject.
But only if you want to be taken seriously.
Here: http://arxiv.org/pdf/1507.03467v1.pdf
Because 1) these geniuses don't know how to do a hyperlink, and 2) the article is completely worthless aside from a link to a page that links to the PDF.
Links that work pls thx.
The links are recursive (they point at /.) so they'd be fuck all use at providing more information - and nothing to do with the crappy summary (SecurityWeek reports). Thanks for nothing Timothy.
Articles from the last week of SecurityWeek about HTML5 and malware 4 security flaws in MSIE, a stupid "story" about old flaws long patched,
This one - paper it's based on is here tl;dr If you don't use stupid (Silverlight, Java, Adobe, Flash) it won't matter.
No, I get a proper, fully rendered page. Why is my CPU at 100%?
Sleep your way to a whiter smile...date a dentist!
obfuscations, that is.
It's so much better than JavaScript, Flash or all the other plugins. You can't turn it off.
Huh? Why better? Oh, did I forget to mention that I'm in IT security?
Very good for the job, that stuff.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because you're still using a single-core CPU.
Get free satoshi (Bitcoin) and Dogecoins
That's what I thought. Thanks.
Get free satoshi (Bitcoin) and Dogecoins
Its funny I was just saying the other day to someone who said now that flash is being mostly canned security should improve.
I said I don't know about that. The massive and rapid expansion of browser features and moving target that is HTML five support where everyone and their brother rushes out extensions is worrisome. I'll be surprised if there are not major exploits in some of that new browser code, especially sandbox escapes via the hardware stuff like webgl and what not. Only now there won't be any simple mitigation like just removing a plugin. You'll have to switch browsers.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Javascript's eval can be very useful in general, and in fact, the most useful form of it is when you *are* invoking it on dynamically generated code that simply cannot be as concisely expressed in any other way. That's not to say it's impossible, but it can often be a darn sight more convoluted to not use eval in Javascript to get a particular job done than it would be to write it using statically compilable code. Some may argue that this is a flaw in the design of the language itself, but I would personally be reluctant to quickly discard the feature entirely simply because of its potential for abuse in this particular way. I would suggest that there are almost certainly other ways to achieve the desired ends, but they most probably involve much more complex intermediate goals.
Blocking eval itself isn't generally a solution anyways, since javascript within the browser could invoke 'document write' to place additional code into the page where it is executing, and then simply directly call a function that it dynamically added to the page using such a technique to achieve the exact same thing as what could be done using eval.
I suspect the longer term solution is for browsers to sandbox javascript pretty tightly.... malicious code that detects such sandboxing as an attempt to evade detection as such may not get detected by the browser as problematic, but still won't be able to accomplish anything because it will still be inside of the sandbox, and when the code tries to do something that is prohibited, it can be immediately flagged at that time rather than just trying to detect it at page load time.
File under 'M' for 'Manic ranting'
Are you telling me that with public acceptance of the vulnerability of Flash, malicious coders have turned to the replacement standard to deliver their malware? Why would they do that? That seems unethical. They should learn to stick to the platforms we know are dangerous, so we know how to protect ourselves.
Have you noticed all the new HTML5 pages mostly major commercial sites have switched to, dyanmic loading, embedded crap could have been bypassed with removal of flash etc... HTML5 is just another example of software designed to require faster computers.. Literally 5 tabs in new modern browser/html5 consume the resources of 40 tabs in Opera v10-v12 with legacy hdmi...
Back in the early days of the web, videos were played by the systems player and a download link; DRM basically spawned flash and what we see today(Forced ads,control)
HTML5, a way to force flash-like tech onto people who knew better to have the crap installed.
As if any browser was capable of using more than one core to render a page. With Chromium or Electrolysis you can have different tabs use more than one core, but there's never any parallelism within a tab. All because of brain-dead design of Javascript.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Because of the "Let the browser take care of my crappy code" mentality, one core could be busy decompressing the insanely-too-large JPEGs so-called "designers" are using, another core is busy wasting cycles to run what should be plain javascript and CSS transitions through half a dozen bloated javascript/HTML libraries/frameworks and another core is busy trying to make any sense whatsoever of the non-valid HTML code because people don't give a damn about matching tag pairs.
The 4th core is alone in the corner, talking with the GPU to render pointless shiny effects for the OS GUI.
Programmers, designers, coders, webmonkeys... we all should be running 5-years-old hardware on 1/4 the connection speeds of the average users. We're the ones making the programs, websites, apps, etc. But no, most of us have the latest hardware, fast connections, etc. That's like letting engineers design roads for their expensive and extremely fast motorcycles. But those roads would be sub-optimal for regular drivers with cars, truckers, etc.
Get free satoshi (Bitcoin) and Dogecoins
guess browser manufacturers should restrict document.write to a "meta allow source", it would breaks direct malicious injection(by console), but crafted messages are not in javascript client side scope, so the data must be filtered/sandboxed at server side if belongs to the scope of injection analisys. at client side there is not much more to do if the client is owned by the attacker.
I do not mind it. I am on the beta testing upgrade track and I report bugs to them. I figure I have used their browser long enough.
With HTML5 I think the trend is going to be an inability to easily use add-ons, as they currently work, to block malicious sites. It will be at that point that I revert to using the HOSTS file. Speaking of which, I downloaded your application but completely forgot to install it and get your email so that I could email you. I should have time to get to that today.
"So long and thanks for all the fish."