hackademix.net

Even if I’m the NoScript guy, I write a lot of JavaScript all the day. As you probably know, even the JavaScript Annihilator is mostly written in JavaScript. Like Crock, I love the language, despite its current browser-bound shortcomings.

So far, my favourite editor for JS coding has been JEdit with its JavaScript plugin, providing syntax highlighting (of course!), on the fly syntax checking via Rhino and optional code completion with configurable scopes, including Mozilla “chrome window” and XPCOM.

But today I’ve watched a presentation of the new NetBeans 6.1 JavaScript capabilities, and I’m impressed.
Dynamic type guessing, browser-specific contextual help and DOM-aware AJAX library support (John, guess which they show in their demo?) may be really worth the switch.

So we’ve got the juicy details now.
On the 2^nd day of the the Pwn2Own contest, Vista has been owned by an unholy trinity of browser technologies:

1. Java has been used to inject the native payload in a known executable memory area, effectively bypassing Vista’s DEP.
2. A Flash vulnerability (an unhandled exceeding function argument, maybe due to a bug in the Visual Studio compiler or linker) has been exploited for jumping to the prefilled location.
3. JavaScript joined the party too, and my educated guess is that it just bridged the pointer location from the Java applet to the Flash object, since both are scriptable.

The full interview with Shane Macaulay (the Flash vulnerability finder) and Alexander Sotirov (of JavaScript Feng Shui fame), who helped with the Java memory preparation trick, is here.
By the way, they say JavaScript Feng Shui had been used to mount the Safari attack which brought down Mac OS X on 1^st day.
Just more confirmations of who the real winner is :)

CanSecWest’s Pwn2Own 2008 contest had heavy coverage in the past days, so I will recap rules and results very quickly.

Three targets, all patched. All in typical client configurations with typical user configurations. You hack it, you get to keep it.

Targets (typical road-warrior clients):

• VAIO VGN-TZ37CN running Ubuntu 7.10
• Fujitsu U810 running Vista Ultimate SP1
• MacBook Air running OSX 10.5.2

Competition started on March 26^th, and was meant to last 3 days with decreasing difficulty level:

1. Bare OS, no extra application
   No laptop got hacked
2. Applications bundled with the OS (e.g. web browser)
   Mac OS X got pwned through a Safari vulnerability
3. 3rd party popular applications
   Vista fell down because of a Flash vulnerability reportedly exploited through a Java vector

Needless to say, after day 2 titles were slight variations on the “Mac OS X Hacked First” theme, while last day the song changed into “Vista Breached, Linux Unbeaten”, casting the event into a security contest among OSes.
While I’m very happy to see a free (as in beer and as in speech) software being depicted by media coverage as the best choice (security wise) over two commercial alternatives, I think that Nathan Mc Feters, even as biased toward Microsoft as he sounds recently, offers a rather objective report:

1. None of the 3 OSes could be violated 1^st day, when pure OS security was tested
2. Mac OS X was taken because the high-level softwares it bundles (especially its web browser and multimedia plugins) are not as safe as its FreeBSD-derivative core
3. Vista was hacked because, notwithstanding all its security enhancements, ubiquitous 3^rd party software can work around them and make a relatively safe OS exploitable

Now some simple considerations:

• Safari is a web browser
• Flash and Java are browser-hosted tecnologies, and they’re both cross-platform: in facts, according to Shane Macaulay who won the Vista laptop, the vulnerabilities he found “could affect Linux or Mac OS X” too
• The browser appears to be the weakest spot in PC security, no matter the OS, while it’s probably the single most used application

Corollary: whatever OS you prefer, never browse the web without NoScript :)

Just 3 of the many reasons why I’m seriously considering to ship next NoScript versions with Forbid Macromedia® Flash®, Forbid Microsoft® Silverlight™ and Forbid other plugins checked by default in the Plugins options panel, like it already happens for Java™:

1. A Quicktime RTSP Response vulnerability is being actively exploited in the wild.
2. Programming errors in Flash or Silverlight applets can be as exploitable as traditional XSS/CSRF, if not more, no matter if the plugin itself is vulnerable or not. If recent attack on RSnake failed, it’s most likely because he had NoScript configured to block Flash even on his own site. Not impractical as it may sound: in facts, you can select Apply these restrictions to trusted sites as well and enable multimedia clips or applets individually, on the fly with a click on their placeholder — that’s exactly what I do, by the way.
3. As Pasqual Meunier of CERIAS put it,
   

   Fully functional PDF viewers are now about as safe and loyal (under your control) as your web browser with full scripting enabled. That may be good enough for some people, but clearly falls short for risk-averse industries.

Update:

Another good reason to keep Flash off by default.

Update 2:

And another… ;)

Update 3:

Oops! :P

Just not to be always destructive, a couple of flash(!) news about browser plugins issues we discussed in the past:

1. The “Quicktime pwns default browsers” bug, after being worked around by Mozilla with the release of Firefox 2.0.0.7, has been fixed on the proper Apple side. Even if the advisory page refers to a SEP 21 date, the actual software update as been published right now.
2. The Java evil popups I demonstrated two months ago have been addressed by Sun.

On a side note, this Saturday I’m gonna get married.
Cheers :)