Feeds

Worms 2.0!

The Metasploit menace inside your firewall

Internet Security Threat Report 2014

Examples of browser communication with a bindshell (behind a firewall) have been done by encapsulating and sending commands in HTTP. These commands echo valid JavaScript and HTML script tags. It literally uses the 'echo' command. The echoed instructions tell the browser to encode the bindshell response and use the response in a new request back to the attacker's web server. This allows the attacker to see the results of the shell commands.

Using the browser as a middleman, the attacker has two way communication. Also, because HTTP is used to send and receive data from the browser it is likely that a Firewall/DMZ will permit the traffic.

Could it work against search engines spiders?

It would depend on the extent to which the spider logic constructs the requests using JavaScript. If it is a fully functioning JavaScript implementation, there is a likelihood that the spider will be capable of Inter-protocol Exploitation just like web browsers.

We talked about web browsers loading the exploit from a website, but could this work with different file formats and software? For example Acrobat Reader comes to my mind for this advisory.

This is a new area of research and there are potentially more inter-protocol issues with web technologies. For one, AJAX can allow more flexibility than the methods discussed in the research. Also, different character sets have the potential to yield more tightly controllable Inter-protocol Exploits.

The recently published acrobat cross-site scripting vulnerability could potentially be used to launch Inter-protocol Exploits. Any issue that has the potential to force an application to make a request with controllable content could be used for attacks, provided it meets the requirements of encapsulation and error tolerance.

The advisory states that the vulnerability does 'allow remote attackers to inject arbitrary JavaScript into a browser session.' Provided there are no other restrictions it will be very similar to using a normal cross-site scripting vulnerability for Inter-protocol Exploitation.

I think it was Nimda that exploited both web servers and browsers to spread... does this approach could be used to install a worm on a webserver, then the browser of every visitor will load some Javascript to exploit a random website that will spread the worm to its visitors, and so on? And this time there is no need to exploit a bug in browsers

It is even simpler. If the attacker used an advanced cross-site scripting virus, the payload would be enough to launch the attack on Internal networks. For example the MySpace virus payload was executed one million times in 20 hours. Inter-protocol Exploitation and advanced cross-site scripting viruses are a dangerous combination.

How do you search for new bugs? How do you develop new attacks?

My work brings me into contact with a wide range of platforms and technologies. In recent times, developing BeEF has supported an interest in the dynamics of component interaction in complex, often eclectic, environments.

Interception proxies are a must when developing web attacks. The Odysseus and Burp proxies allow a lot of control over HTTP communication. Increasingly, I am finding the need for generic network proxies like Echo Mirage that hook into network function calls.

Another tool which I couldn't do without is netcat. It is simple and powerful - a great combination. ®

Wade Alcorn is a security researcher/consultant living in Brisbane, Australia. His permanent role at NGS Consulting is Principal Security Consultant. Further to consultancy engagements he has contributed various security tools and published vulnerabilities and white papers.

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.