|
Browsing
Websites at your own risk. - Hiding behind your web browser - Obscure^ obscure@eyeonsecurity.org
-Intro
In this article I'll be describing some of the ways your browser, may it be MsIE, Netscape or whatever, gives out far too much information about you, or worse gives everyone full access to your machine. I won't be going into the philosophy and reasons behind anonymity, since I guess everyone has his own reasons. However I'll be focusing mainly on Ms Internet Explorer and Netscape, with reference to E-mail clients, most of which inherit the problems found in the Web Browser technologies. I will not be covering why you should (or maybe shouldn't), be concerned about your privacy, anonymity and security of your "personal" computer. I guess everyone out their has their own reasons, may they be legal or otherwise, justified or evil.
-HTTP Protocol & Anonymity
GET /test.html HTTP/1.1 Once a a TCP/IP connection the the webserver is achieved, the IP address of the client is logged and the HTTP request sent. Any or all of the above information the request be logged as well. Therefore OS and browser type and version are easily given out. The pointing web page URL is also sent via the referer option. Your IP address is always given out (unless you prevent that) to the webserver since it needs to know who to send data to (as with all TCP/IP protocols). That is where "anonymous" proxies come in. By bouncing through these anonymous proxies (may be anything, HTTP proxy like squid, socks v.4, or telnet session) should in theory block your IP address from showing up in the log files. This is obviously not true (see the javascript section), since there are other ways to get your IP address, apart from other info. A referer is the webpage that actually pointed to the site you're requesting. This spells trouble for obvious reasons (passwords embed URLs, internal websites, administrative services running HTTP etc.). Same as above I would suggest using an Anonymous Proxy that do not send this information in the HTTP request. Much of the same goes for the rest of the HTTP request options. Basic HTTP Authentication is the standard authentication method used over the HTTP protocol. It passes Usernames, Passwords and Realms in clear text. This means that anyone sniffing your connection or successfully executing a man in the middle attack (using hunt for example) can easily gain access to whatever you can gain access to. The solution to this problem is to use SSL over HTTP instead of the standard unencrypted HTTP method for Authentication. This is actually not a generic Web Browser problem, but rather a security problem in the HTTP protocol.
-External Viewers
-Javascript and similar Embedded scripting technologies
Javascript has built in functions to retrieve the client's web browser properties. Integrated into Javascript and VBscript, in MS Internet Explorer, we have support for ActiveX technology. Any evil ideas yet ? Besides that Javascript has been (and still is for some services) used for exploiting Web Mail services such as Hotmail and Yahoo mail, to allow an attacker gain access to the mailbox by redirecting a target to his site, posing as being the Web Mail service and ask for the password. Exploits for Javascript have been cropping up since it was first implemented. Public exploits for previous and current versions allow a malicious user to read local files on a remote machine visiting his website or by sending html e-mail (through Outlook for example). Besides that as hinted two paragraphs ago, embedded scripts like javascript are usually used to exploit Java and ActiveX problems as well.
-Java problems
In another exploit involving Java, dubbed as Brown Orifice, Netscape could ironically be set up to act as a Web Server, and Ms Internet Explorer as a Proxy Server!
-Cookies
Most problems around cookies arise when a Malicious web master is able to read other sites' cookies. Therefore websites should never store sensitive information in cookies such as credit card numbers, passwords etc., and users should change default settings to only allow the originating domain read/write to their cookie. There was also a security flaw within Netscape related to cookies that allows malicious users to embed javascript code to cookies to read html files on the victim's hard disk.
-ActiveX Insecure Technologies
The main problem lies in executing ActiveX components marked as safe that allow scripting or access to local hard disk, i.e. access to functions not usually allowed to Web Browsers. An exploit for Ms Internet Explorer 5.01 in conjunction with MS Office 2000 and 97 uncovered a major security flaw which allowed a malicious user to execute the exploit even if the security settings were set to disable ActiveX. ActiveX technology allows remote virus scanners to scan your hard disk. Therefore no downloading time etc. This obviously means giving them access to your hard disk. This relies on certificates and asks the user if he wants to download and execute the ActiveX content.
-Other Possibilities As in any other application, there is always the possibility of a generic attack such as buffer overflows. A buffer overflow vulnerability in Netscape 4.x exists in viewing Image files. Apart from that, both novice and advanced users could be tricked in supplying personal information which could easily lead to spamming to access to local machine. One such obvious problem which is usually overlooked is the use of password. An old exploit consists of a malicious user (com)promising/providing a service which requires a password such as free e-mail accounts. Next time the victim tries to log on to his e-mail account he finds that his old password doesn't work and tries all his known passwords in hope that he used them instead. Old, but most of the time, it works!
-Solutions
As well as filtering what you're sending, it is also very important to filter what coming in. Therefore the proxy should check for ActiveX objects, embed media files, embed script tags, javascript commands inside images etc. I guess this proposed technology could also be applied to statefull inspection (i.e. advanced) firewalls utilizing packet filtering technologies. Keeping up to date with the latest patches for your HTTP client helps as well, since no solution is able to give you full security against these type of attacks.As HTTP technology continues to become more interactive, and obviously more scriptable, we'll continue to see more flaws to endanger our stay on the 'net.
-Reference http://www.w3.org/Security/Faq/wwwsf7.html |
