SecurityFeed.info » hackademix.net

« Expand/Collapse

hackademix.net (10 unread)

December 23, 2008
14:59
NoScript for Fennec Update
» ‎ hackademix.net

Fennec Alpha2 is out, breaking compatibility with NoScript up to 1.8.7.7 because of a change in the Browser object hierarchy.
If you’re using NoScript on Fennec (or you want to give it a try), please get the NoScript 1.8.7.8 development build.
A stable AMO release should follow in one day or two. upgrade to NoScript 1.8.8
December 20, 2008
2:27
Introducing ABE
» ‎ hackademix.net
During the past weeks I’ve started a new project called ABE, sponsored by the NLnet Foundation and meant to provide CSRF countermeasures configurable on the client side, the server side or both.

As you probably know, the NoScript browser extension improves web client security by applying a Default Deny policy to JavaScript, Java, Flash and other active content and providing users with an one-click interface to easily whitelist sites they trust for active content execution. It also implements the most effective Cross-Site Scripting (XSS) filters available on the client side, covering Type-0 and Type-1 XSS attacks; ClearClick, the only specific browser countermeasure currently available against ClickJacking/UI redressing attacks, and many other security enhancements, including a limited form of protection against Cross-Site Request Forgery (CSRF) attacks: POST requests from non-whitelisted (unknown or untrusted) sites are stripped out of their payload and turned into idempotent GET requests.

Many of the threats NoScript is currently capable of handling, such as XSS, CSRF or ClickJacking, have one common evil root: lack of proper isolation at the web application level. Since the web has not been originally conceived as an application platform, it misses some key features required for ensuring application security. Actually, it cannot even define what a “web application” is, or declare its boundaries especially if they span across multiple domains, a scenario becoming more common and common in these “mashups” and “social media” days.

The idea behind the Application Boundaries Enforcer (ABE) module is hardening the web application oriented protections already provided by NoScript, by developing a firewall-like component running inside the browser. It will be specialized in defining and guarding the boundaries of each sensitive web application relevant to the user (e.g. webmail, online banking and so on), according to policies defined either by the user himself, or by the web developer/administrator, or by a trusted 3^rd party.

ABE rules, whose syntax is defined in this specification (pdf), are quite simple and intuitive, especially if you ever looked at a firewall policy file:
```
# This one defines normal application behavior, allowing hyperlinking
# but not cross-site POST requests altering app status
# Additionally, pages can be embedded as subdocuments only by documents from
# the same domain (this prevents ClickJacking/UI redressing attacks)
Site *.somesite.com
Accept POST, SUBDOC from SELF, https://secure.somesite.com
Accept GET
Deny

# This one guards logout, which is foolish enough to accept GET and
# therefore we need to guard against trivial CSRF (e.g. via <img>)
Site www.somesite.com/logout
Accept GET, POST from SELF
Deny

# This one guards the local network, like LocalRodeo
# LOCAL is a placeholder which matches all the LAN
# subnets (possibly configurable) and localhost
Site LOCAL
Accept from LOCAL
Deny

# This one strips off any authentication data
# (Auth and Cookie headers) from requests outside the
# application domains, like RequestRodeo
Site *.webapp.net
Accept ALL from *.webapp.net
Logout
```
Living inside the browser, the ABE component can take advantage of its privileged placement for enforcing web application boundaries, because it always knows the real origin of each HTTP request, rather than a possibly missing or forged (even for privacy reasons) HTTP Referer header, and can learn from user’s feedback.
Rules for the most popular web applications will be made downloadable and/or available via automatic updates for opt-in subscribers, and UI front-ends will be provided to edit them manually or through a transparent auto-learning process, while browsing. Additionally, web developers or administrator will be able to declare policies for their own web applications: ABE will honor them, unless they conflict with more restrictive user-defined rules.
As soon as browser support for the Origin HTTP header becomes widespread and reliable, an external version of ABE might be developed as a filtering proxy.

An initial implementation will be released during the 1^st quarter of 2009 as a NoScript module.
I already collected precious feedback from security researchers like Arshan “Anti-Samy” Dabirsiaghi, Ivan Ristic of ModSecurity fame, Sirdarckcat and others.
More opinions and suggestions about rules design and features are very welcome.
December 17, 2008
16:28
Opera, Firefox and IE Security Updates: All Together, All the Same?
» ‎ hackademix.net
Yesterday and today we’ve got a blizzard of web browser security updates:
- Opera releases version 9.63, fixing 3 remote execution bugs and other security issues.
- Mozilla releases Firefox 3.0.5, fixing 3 remote execution bugs and other security issues.
- Microsoft is about to release an out of band patch for its IE data-binding remote execution vulnerability which escaped the patch pack issued on Tue, Dec 9th.
Microsoft zealots are taking this as an argument to argue that all browsers are equally insecure, and therefore there’s no reason to switch (from IE) for security purposes (an advice which, on the other hand, starts spreading even on mainstream media).
This is quite a debatable statement, if you think about it.
IE’s vulnerability, being a zero day, is actively exploited in the wild by thousands of compromised web sites and puts several millions of users worldwide at risk, while both Firefox’s and Opera’s are still embargoed.
Firefox will be automatically updated for its users before bad guys can analyze and exploit the patched vulnerabilities. That’s effective patching. Opera is in a slightly worse shape, since its update mechanism is not fully automated (it requires user to manually download and install the new version). Microsoft already failed this time, because the vulnerability has been already known and exploited for more than one week.
Right, zero day situations can happen to any software product, and Opera and Firefox might face a similar shitstorm tomorrow. But, even so, there are some interesting differences:
1. Patching policies: Microsoft implements a predictable monthly patching cycle. This is probably good for corporate IT departments, which can carefully plan the so called “black Tuesday” to minimize their troubles, but it’s also good for evildoers and security attention-bitches, who can carefully plan their exploits or disclosures to maximize their impact. Zero day critical vulnerabilities in three different Microsoft products have been disclosed immediately after last “black Tuesday”: is this really a coincidence?
  Firefox and Opera, on the other hand, issue security updates whenever they’re ready and tested.
2. Agility: as everybody knows, Internet Explorer is tightly coupled with the underlying Windows OS platform, and this makes both mitigation and fixing more difficult. In this case, for instance, the suggested work-around required not just hardening the browser itself by blocking scripts and plugins, but also disabling a system-wide data access component (OLEDB): this affected not just surfing the web, with many sites inaccessible or malfunctioning, but also most Windows applications relying upon databases.
3. Viable ad-interim mitigation: even if a browser vulnerability doesn’t involve system-wide components, mitigation until a patch is available almost always requires disabling JavaScript and/or plugin content (the latter is often used to circumvent security features like Vista’s DEP). On IE, such a work-around is hardly acceptable, since “Security Zones”, the mechanism available to selectively change the security level of certain pages, is very obtrusive and almost unusable (yes, way worse than UAC). Opera is friendlier, thanks to its “Site Preferences” which let user quickly change site permissions for JavaScript, Java, Flash and so on. Of course, only a minority of Opera users actually configure a default-deny policy, to selectively allow active content on trusted sites only. However, even those savvy users are suddenly out of luck, if they grant permissions to a site which is vulnerable to XSS: an attacker could circumvent script and plugin blocking by injecting his malicious code there, where it’s allowed to run. But if you use Firefox and you install NoScript, you get a safe default-deny policy configured out of the box and your trusted whitelist is effectively enforced notwithstanding site flaws, thanks to Anti-XSS Protection: JavaScript and other active content will run only where you want it to run.
To summarize: all the browsers can have vulnerabilities and equally need timely patching, but not all the users are equally vulnerable.
December 14, 2008
0:26
It’s simple like…
» ‎ hackademix.net

Microsoft’s “clarification” on the various workarounds for the recent Internet Explorer security debacle.
December 12, 2008
18:09
More Bad News for IE Users
» ‎ hackademix.net
Latest updates from Microsoft: the critical remote execution bug which we already talked about affects all IE versions (included IE8 beta) on every supported Windows operating system.
The bulletin also corrects some early assumptions about this unpatched vulnerability, which is being actively exploited in the wild from apparently legitimate sites infected through automated SQL injections:
- The hole is in data binding, and not in XML processing like many (me too) reported initially.
- Increasing the security level of the Internet Zone to “High” and disabling active scripting does not suffice to protect you, even if it makes attacker’s life slightly harder. Not harder than yours, though, since Microsoft’s “Security Zones” have nothing of NoScript’s usability…
The only work-around suggested by Microsoft is disabling both active scripting and the OLEDB32 library, which is unluckily required by most applications working with databases.

So, do you really want to keep inflicting yourself that blue “e”? Or are you ready for a red panda?
December 11, 2008
13:32
Escape From IE, Now!
» ‎ hackademix.net
You may have heard of Microsoft Update’s debacle past Tuesday, with two critical Windows vulnerabilities disclosed when it was too late for this patching cycle:
- A flaw affecting the Word97 converter for WordPad on Windows XP SP2 and below, which is exploited by enticing users into opening a document with “.wri” file extension.
- A juicier bug in Internet Explorer 7’s XML parser, any version, related to data binding, affecting all recent Windows operating systems up to Windows 2008 and Vista SP1. It is exploited automatically, without user intervention, to execute arbitrary code from malicious web sites.
I said “is exploited“, rather than “can be exploited”, because both these 0 day vulnerabilities are being actively exploited in the wild.
I also deleted “malicious” near “web sites”, because exploits for the latter vulnerability are being massively infiltrated inside legit web sites using automated SQL injection attacks.
Give yourself a Christmas gift: if there’s a best moment for switching to a safe or to a safer browser, that’s now.
December 07, 2008
21:18
Samy, Anti-Samy and the Devil
» ‎ hackademix.net

Dec 6, 7:25 PM, IM
Arshan* to me:

noscript saved me today, literally, from none other than the infamous samy
Dec 7, 3:16 AM, Email
From: samy**
To: Giorgio Maone
Subject: giorgio, i’m mad at you

Giorgio,

I am mad at you. My friend, Arshan Dabirsiaghi, whom I will refer to from now on only as “the persian”, was viewing a web page. The web page in question had what the kids these days are calling, “XSS”. The XSS was malicious. As malicious as a chicken nugget from McDonalds. Worse, maybe.

But you see, my friend, the persian, was not affected. Why is this you ask? I asked him the same thing. He told me that I should blame you for him being safe. I don’t think he literally meant come to you and blame you, but you see, I am coming to you anyway and blaming you. He was running this extension (of his penis) known only as NoScript, or what I will refer to as “the devil’s plugin”. And for this, I am angry. Angry at the plugin, the use of it, and by extension the author. You, sir, you. That is all. All I can do now is attempt to correct your rights.

Good morrow to you, fine sir.

Your frienemy,
samy
*Arshan Dabirsiaghi of Aspect Security and OWASP, lead developer of the OWASP Anti-Samy Project. ** The infamous Samy, author of the eponymous MySpace XSS Worm. Update
The original Samy’s message contained a slightly antizionist joke about Arshan’s supposed descent. I edited it out even if Samy gave his consent for verbatim publishing, because Guanxi made me notice that some people may find it offensive rather than parodic, or even worse read it as an implicit justification for antisemitism.
Update 2
I re-edited the original message after Samy suggested me a way to make it become, “all of the sudden accurate rather than offensive”.
December 02, 2008
16:40
Go Green with NoScript!
» ‎ hackademix.net

SecTheory published a paper by Robert “RSnake” Hansen about Browser Power Consumption. Dan Goodin reports about it under the rather funny title Study spanks Adobe Flash for abuses of power (ehy Dan, why just Adobe? what about Microsoft and Sun?). PC World has an article as well, interviewing a Pacific Gas and Electric representative.

The green juice: you can reduce your PC’s power consumption by 25% when you browse the web using Firefox with NoScript and AdBlock Plus. Quite obvious, since JavaScript, Flash, Java, Silverlight and active content in general are major CPU-drainers, compared to static pages. By allowing them just when and where they’re needed, the way NoScript works, you do the equivalent of closing the tap when you’re brushing your teeth or turn off the light when you exit a room.

Of course it’s just a drop in the ocean, but I like to believe I’m helping Gaia a bit and enabling others to do the same :)
Update
Commenter Arthur reminded me that, even if you didn’t give a damn about environment health, as a mobile user you surely value your battery life and you’ve got yet another good reason for using NoScript. And did I mention you can use NoScript on the Fennec mobile browser now?
November 06, 2008
19:04
Suntanned
» ‎ hackademix.net

“Obama is young, handsome, and suntanned too.”

Silvio Berlusconi during today’s official Russia-Italy press conference in Moscow

In other news, I’m about to release first official NoScript version with Fennec support, so please wait a few hours before bombing Italy.
November 05, 2008
15:29
Thanks America!
» ‎ hackademix.net
- Forbid fear.com
- Allow hope.org
You’ve done the right thing :)

← pwn* SecurityDot Vulnerabilities →

SecurityFeed.info » hackademix.net

Feeds

hackademix.net (10 unread)