XSS Worm : Cross Site Scripting & Web 2.0 Security

Dr Craig Wright has described a new attack vector known as Cross-Site Faxing (XSF) that abuses weaknesses in OCR 2.0 anti-phishing technology to bypass commercial anti-CSF appliances such as the i-XSS BloggerShield and UBsecure’s new XRCF Webfender 2.1.

On Nov 18, Dr Craig Wright (cwright@bdosyd.com.au) writes to pen-test:

“I have thought of an alternate path to loading a virus bases on a network OCR’d fax server. In the scenario, we have to assume that the system is sending the output to a web front end or HTTP enabled email (not that uncommon).”

Dr Wright subsequently illustrates to the reader what he has previously written using the following hypothetical scenario:

• The system has no input filters and prints all characters to the email, web app.
• The OCR engine is highly accurate and does not add spaces etc.
• The email or web app displays exactly what it received

“Now given that scenario, we have a possible XSS (cross-site-scripting) attack. If there are no filters for an outgoing connection (i.e. no firewall/proxy that strips scripts) and the client browser/email application allows access to the Internet, the attacker could create a script in the page that makes a call to an external system to download a file … a script could also embed a simple XOR obfuscation key to modify the downloaded code. On the web server it would be inert. When XOR’d with the key in the script (after being downloaded and installed), this will thus bypass the AV server (if there is one) and install the malware on the users system. […] Regards, Dr Craig Wright (GSE-Compliance)”

It is interesting to see this challenge considered by the security community. Are there currently any products we can purchase to scan incoming faxes? What about physical mail? A malicious attacker could embed scripting into an application form that is then printed and sent through snail mail to a recipient mail desk which scans the mail and forwards as a pdf or tiff image to the unsuspecting victim.

This attack is very deadly as it takes advantage of embed or macro or client side exploits against pdf or tiff clients and users. This is a very dangerous attack vector that must be explored, and all security consultants are encouraged to alert the wider community of the dangers of Cross Site Faxing and Cross-Site Postage exploits.

White hat, gray hat, black hat: no, we’re not talking about hat styles, but hackers. What are they, how do they differ, and are all of them super-evil?

SEO search engine manipulators also call each other blackhats. Also discussed is anecdotals about dogs and hacking.

Black-Hat Hacker

A black hat or black-hat hacker is a malicious or criminal hacker. The term hacker is also commonly is used as a synonym for “black hat hacker”. However, in computer jargon, the meaning of “hacker” is much more broad.

(New readers of security may refer to our Hacker Dictionary for more information)

Usually a Black Hat refers to a person that maintains knowlege of the vulnerabilities and exploits they find as secret for private advantage, not revealing them either to the general public or manufacturer for correction. Many Black Hats promote individual freedom and accessibility over privacy and security. Black Hats may seek to expand holes in systems; any attempts made to patch software are generally to prevent others from also compromising a system they have already obtained secure control over. A Black Hat hacker may have access to 0-day exploits (private software that exploits security vulnerabilities; 0-day exploits have not been distributed to the public). In the most extreme cases, Black Hats may work to cause damage maliciously, and/or make threats to do so for blackmail purposes.

From : http://www.elitehackers.info/ethic.php

The “black hat” is any person who used their knowledge of vulnerabilities exploits for private gain, rather than revealing them either to the general public or the manufacturer for correction. Many black hat hackers use hacking to hack into networks and web pages solely for financial gain. Black_hats may seek to expand holes in systems; any attempts made to patch software are generally done to prevent others from also compromising a system they have already obtained secure control over. A black hat hacker may write their own zero-day exploits (private software that exploits security vulnerabilities; 0-day exploits have not been distributed to the public). In the most extreme cases, black hats may work to cause damage maliciously, and/or make threats to do so as extortion.

Further Blackhat Resources:

• Internet troll
• List of convicted computer criminals
• Phrack
• White hat

White-Hat Hacker

A white hat hacker, also rendered as whitehat or white-hat, is, in the realm of information technology, a person who is ethically opposed to the abuse of computer systems. Realizing that the Internet now represents human voices from all around the world makes the defense of its integrity an important pastime for many. A white hat generally focuses on securing IT systems, whereas a black hat (the opposite) would like to break into them but this is a simplification. A black hat will wish to secure his own machine, and a white hat might need to break into a black hat’s machine in the course of an investigation. What exactly differentiates white hats and black hats is open to interpretation, but white hats tend to cite altruistic motivations.

From : http://www.elitehackers.info/ethic.php

The term white hat hacker is also often used to describe those who attempt to break into systems or networks in order to help the owners of the system by making them aware of security flaws, or to perform some other altruistic activity. Many such people are employed by computer security companies; these professionals are sometimes called sneakers.

Notes: In recent years the terms white hat and black hat have been applied to the Search Engine Optimization (SEO) industry. Black hat SEO tactics, also called spamdexing, attempt unfairly to redirect search results to particular target pages, whereas white hat methods are generally approved by the search engines.

Resources:

• Hiring Hackers As Security Consultants
• The Ethical Hacker Network - Free Online Magazine for Security Professionals