full-disclosure - Imposter v0.9 download. Two whitepapers on file stealing using IE and attacking Google Gears released.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <17ad77481003021221v3deeda1pdb944f0e5638a7f1@mail.gmail.com>
Date: Wed, 3 Mar 2010 01:51:34 +0530
From: Lavakumar Kuppan <lava@...labs.org>
To: full-disclosure@...ts.grok.org.uk
Subject: Imposter v0.9 download. Two whitepapers on file
	stealing using IE and attacking Google Gears released.

Hello,

Recently I have been speaking in a few conferences about browser phishing
attacks. These attacks are performed against the browser and require no user
interaction.

Some of the attack highlights are:

1) Can steal files from the local file system of Internet Explorer users.
2) Can steal client-side databases including the Gmail and MySpace Inbox of
Google Gears user's.
3) Can place 7 different types of permanent backdoors in the browsers of
Google Gears users.
4) Can steal the passwords stored in FireFox (similar to Karmetasploit)

I am releasing two whitepapers detailing these attacks:

1) Flash + IE = Prison Break -
http://andlabs.org/whitepapers/F_IE_PrisonBreak.pdf

    Explains how a flash file running inside Internet Explorer can read from
the local file system of the victim and transfer it to the attacker.

 2) Google Gears for Attackers -
http://andlabs.org/whitepapers/GoogleGears_for_Attackers.pdf

    Explains the different kinds of data stealing and backdoor placing
attacks that can be performed against Google Gears. It also has details
about what is probably the first publicly released Persistent XSS
vulnerability based on Google Gears. This vulnerability is on MySpace.

I am also releasing Imposter which is a tool to perform these and other
similar attacks. It has an internal DNS server, Web Server and SMB packet
Sniffer.

The attacks performed by Imposter are:
1) Steal files from the victim's local file system
2) Steal data from Google Gears database
3) Place backdoors in Google Gears ResourceStores and ManagedResourceStores
4) Steal passwords from FireFox's password store
5) Steal cached files from the victim's browser
6) Poison the victim's browser cache.
7) Steal and set cookies in the victim's browser
8) Steal LocalSharedObjects from the victim's browser

Imposter can be downloaded from http://andlabs.org/tools.html#imposter

I hope you find this information interesting and useful. All comments and
suggestions are welcome.

Cheers,
Lava
Attack and Defense Labs
http://www.andlabs.org

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/