bugtraq - Re: SUPER SPOOF DELUXE Re: Microsoft and Security

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <52bc3e18040702081747deafe2@mail.gmail.com>
Date: Fri, 2 Jul 2004 11:17:41 -0400
From: Bob Perriero <bob.perriero@...il.com>
To: Thor Larholm <thor@...x.com>
Cc: Pavel Kankovsky <peak@...o.troja.mff.cuni.cz>, bugtraq@...urityfocus.com,
   full-disclosure@...ts.netsys.com
Subject: Re: SUPER SPOOF DELUXE Re: Microsoft and Security


The problem with thinking like that though is you aren't taking the
consumer into account. Say my mom or dad want to pay their visa bill
and they are unsure where to go on the internet to pay. They do a
google search and sure enough,  the find a page that has a link to
visas payment portal or account login page. Now they are happy because
even though they are not as technically advanced as people on this
list, and they did eventually get to the visa site on their own. They
checked the URL and made sure that it was the visa site that they were
at. But regardless of what they did to protect themselves, they still
become the victims of identity theft. How much more is the average
consumer who uses the computer a max of 2 hours a week expected to
know? You surely don't expect them to start learning about frames
sources or automatic redirects in their web browser, do you?
-Bob

On Thu, 1 Jul 2004 18:00:07 -0700, Thor Larholm <thor@...x.com> wrote:
> 
> > From: Pavel Kankovsky [mailto:peak@...o.troja.mff.cuni.cz]
> 
> > If a script from site A can replace the contents of a frame
> > within a document from site B then site A is able to violate
> > the *integrity* of B's contents. This is unacceptable.
> 
> A script from site A can only replace the contents of a window object
> within a frame from site B if site B is specifically opened through
> scripting from site A. Site A cannot interact with any window object
> that it has not created itself, it has to open a new window, wait for it
> to load and then load a new document in the frame inside this new
> window. It doesn't even know if you already have an existing browser
> window pointing at WindowsUpdate or your banking site because it didn't
> open those windows.
> 
> You have to look at the prerequisite attack scenario. You are surfing to
> some random site and out of nowhere it opens WellsFargo.com or
> WindowsUpdate. At this point you are thinking one of 2 things, either
> 
> "What the.. I didn't go to WindowsUpdate/WellsFargo .. Let me just close
> that window .. Damn popups"
> 
> or
> 
> "Hey how nice, WindowsUpdate/WellsFargo magically appeared in front of
> me and I didn't even intend to go there .. I was just surfing for porn
> .. Let me hurridly download some stuff from there and give it my account
> details"
> 
> 
> Thor
> 
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html