Feeds

Google gears Gmail for PC hack attack

'Offline' web apps exposed

Protecting against web application threats using SSL

Over the past year, dozens of web-based services have adopted new features that allow them to be used even when an internet connection isn't available. The technologies making this possible may offer plenty of convenience, but they also make end users susceptible to powerful new attacks, a security researcher warns.

So-called offline web applications are springing up like weeds, thanks in large part to Gears, an open-source project spawned by Google that allows data normally stored on a webserver to be stashed instead on end users' computers. Last month, Gmail joined the party, allowing the masses to read and write email even when they're not connected to the interwebs.

Like almost all other offline web applications, offline Gmail works by creating the equivalent of a relational database on the client PC. The result: a single cross-site scripting (XSS) error or SQL injection vulnerability on the web server is all it takes to gain full access to the contents, says Michael Sutton, vice president of research at web security firm Zscaler. He plans to discuss his findings in detail on Wednesday at the Black Hat security conference in Washington.

"It really changes the landscape from an attacker's perspective," Sutton says. "I as an end user can have a fully patched system surfing a reputable site and still be vulnerable because there is a weakness on the page I'm viewing. You are actually made vulnerable if the site has a vulnerability in it."

To prove his point, Sutton identified a SQL injection vulnerability in a time-keeping service offered by a website called Paymo. By embedding select commands into various Paymo URLs, he was able to pluck information stored on a PC that had been using the service's offline feature, he says.

Paymo promptly fixed the bug. But Sutton says the vulnerability amounts to a proof of concept for a new class of attacks that targets users of offline web services. Such "persistent client side storage" attacks, as he has dubbed them, have the potential to target victims each time they interact with a vulnerable service, he warns.

What's more, because the services are generally available to anyone for free, it's possible for attackers to have detailed knowledge of exactly how the databases are configured, an understanding that could go a long way to improving the odds of successfully exploiting the vulnerability.

"There is a real database living within your browser if you're adopting some of these newer technologies, and it's actually easier from an attacker's perspective because I don't have to guess what the structure of the data is," he says.

Because it works on Windows, OS X, and Linux, Gears is by far the most popular way of bringing offline functionality to web services. But it's not the only way websites can make such offerings available. HTML 5, which is still under development, also describes ways for browsers to have local databases that interact with websites. Apple's Safari browser has already implemented part of that.

That has led Sutton to envision a day when most internet users have a wealth of locally stored data on their PCs that seamlessly interacts with websites. Suddenly, XSS exploits - which typically allow attackers to steal only limited amounts of data, such as authentication cookies - could be used to purloin entire databases, he warns.

"These are cool technologies, and they should be adopted," he says. "But you have to understand the risk. It increases the level of risk, and you also need to increase the level of testing to secure it." ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.