Message-ID: <20061128012812.24270.qmail@cgisecurity.net>
Date: Mon, 27 Nov 2006 20:28:12 -0500 (EST)
From: bugtraq@...security.net
To: pdp.gnucitizen@...glemail.com (\"pdp architect\")
Cc: websecurity@...appsec.org,
	webappsec@...urityfocus.com (Web Application Security),
	bugtraq@...urityfocus.com, security-basics@...urityfocus.com,
	pen-test@...urityfocus.com (Penetration Testing)
Subject: Re: [WEB SECURITY] The state of JavaScript Hacking

> Mozilla with their XUL makes attackers life so much easier. It is not
> that the Mozilla browser is vulnerable to any specific type of attack
> but the past has already proved many times that eventually someone
> will find an issue with the architecture. Then people will find the
> same mistake in other places. The Mozilla XUL is considered a true RIA
> (Rich Internet Application) platform that is currently the base of
> many open source products. All of them support JavaScript, CSS, Flash
> (if installed) and Java (if installed). If the developers of these
> applications don't have deep understandings of the security
> implications of the Mozilla platform the WEB will become suddenly very
> dangerous place for them.
> 
> Last but not least we have Microsoft with their XAML and WPF (Windows
> Presentation Foundation). I am sure that not that many people have
> heard of these technologies so let me explain what they are in brief.
> They are the Microsoft's way to do RIA. The only thing is that they
> relay on .NET3 which makes them explicitly for Windows. I am not sure
> what is the state of the MONO project though.
> 
> WPF will allow you to build Rich Internet Applications with XML, CSS
> and .NET. .NET supports many languages one of which is JavaScript. Try
> to do some coding in ASP and you will see that it feels the same as
> browser JavaScript. This is JavaScript on the server, the browser and
> the desktop. It enables web worms and future high-end attackers to a
> degree hardly imaginable by anyone today.


I've been waiting awhile to see someone talk about this! :)

It is good to hear some conversation about XUL and WPF/XAML as these kinds of applications/technologies will change
the way we use the web. For those who know nothing about these technologies picture a windows application running
inside of your browser having the same look/feel as a non web application (a pretty applet). One of the initial concerns involves
the users inability to 'be aware of' application changes initiated potentially via XSS or other types of script injection.
One could XSS a site, change the URL to the sites RIA application to their own, and potentially act as a proxy with
the real application without the users knowledge. Does anyone know of any decent links/tutorials on signing XUL/WPF/XAML apps
to prevent such situations?

One of the neat .NET 3.0 features allows a developer to at compile time decide if an application is web based or standalone. So
for those of you who have written applets instead of modifying code you just change a compile time option.

"Finally, it is worth noting that Windows executables can be hosted in a window (by default) as well as in the browser. In both cases, the code remains the same and only needs to be compiled again with a different project property.
"
- http://msdn.microsoft.com/msdnmag/issues/04/01/DevelopingAppsforLonghorn/


Additional reading for those interested 
http://blogs.msdn.com/mharsh/archive/2006/03/23/559106.aspx
http://msdn2.microsoft.com/en-us/library/ms746927.aspx

Sample applications:
http://www.charlespetzold.com/wpf/

- zeno
http://www.cgisecurity.com Website Security news and more!
http://www.cgisecurity.com/index.rss [RSS Feed]

Powered by blists - more mailing lists