Search the Community

OVERVIEW ========== The 4/8/2015 security updates from Apple included a patch for a Safari cross-domain vulnerability. An attacker could create web content which, when viewed by a target user, bypasses some of the normal cross-domain restrictions to access or modify HTTP cookies belonging to any website. Most websites which allow user logins store their authentication information (usually session keys) in cookies. Access to these cookies would allow hijacking authenticated sessions. Cookies can also contain other sensitive information. All tested Safari versions on iOS, OS X, and Windows were vulnerable. The number of affected devices may be of the order of 1 billion. Technically, the attacker can spoof the âdocument.domainâ property. Itâs possible that this could lead to compromise of other resources apart from cookies. However, cookies was the only practical attack scenario found with the tested versions of Safari. The HttpOnly and Secure cookie flags represent an important mitigating factor albeit with some caveats (see below). DETAILS ======== Safari supports the FTP URL scheme allowing HTML documents to be accessed via URLs beginning with "ftp://". These URLs can be of the form [url]ftp://user:password@host/path[/url]. The problem arises when encoded special characters are used in the user or password parts. Consider the following URL: [url]ftp://user%40attacker.com%2Fexploit.html%23@apple.com/[/url] If correctly interpreted, the URL refers to a document on apple.com. However, when loaded by a vulnerable browser, the network layer uses an extraneously decoded version of the URL: [url]ftp://user@attacker.com/exploit.html#apple.com/[/url] The document would be loaded from attacker.com, not apple.com. Yet the document properties such as âdocument.domainâ and âdocument.cookieâ are correctly initialised using âapple.comâ. The attacker-supplied document, exploit.html, can therefore access and modify cookies belonging to apple.com via JavaScript. Itâs possible that cookies arenât the only resource accessible this way, but at least recent Safari versions (tested desktop only) use the document origin instead of only host or domain for most other access control, e.g. password autofilling and geolocation permissions. The attack can be performed on normal web pages by embedding an IFRAME pointing to an FTP URL. MITIGATING FACTORS =================== The cookie attack requires JavaScript so existing cookies with the HttpOnly flag canât be seen by the attacker. Support for this flag reportedly appeared in Safari 4. Earlier versions would be vulnerable even with the HttpOnly flag. Safari allows (over)writing of HttpOnly cookies so the flag doesnât prevent this vulnerability to be exploited for session fixation and similar attacks. Cookies with the Secure flag arenât accessible for documents loaded via FTP. VULNERABLE VERSIONS ===================== The following versions were tested and found vulnerable: - Safari 7.0.4 on OS X 10.9.3 - Safari on iPhone 3GS, iOS 6.1.6 - Safari on iOS 8.1 simulator - Safari 5.1.7 on Windows 8.1 Earlier versions werenât available for testing, but according to available statistics their usage should be negligible. SOLUTION ========= Apple was notified on January 27, 2015. The following patches were released in April 2015: - APPLE-SA-2015-04-08-3 iOS 8.3 - iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later - APPLE-SA-2015-04-08-1 Safari 8.0.5, Safari 7.1.5, and Safari 6.2.5 - OS X Mountain Lion, Mavericks, Yosemite For more information see: [url]https://support.apple.com/en-us/HT201222[/url] WORKAROUND ============= The attacker has to set up an FTP server or use an existing public one. Such server can run on any TCP/IP port number. One way to stop such attacks (e.g. for older devices with no available patch) would be to deny all traffic to the public internet and configure the device to use a HTTP proxy located in the internal network. This should prevent access to all FTP URLs. CREDITS ======== The vulnerability was found and researched by Jouko Pynn??nen of Klikki Oy, Finland. -- Jouko Pynnonen <jouko@iki.fi> Klikki Oy - [url=http://klikki.fi]Klikki Oy -[/url] - @klikkioy Source: http://packetstorm.wowhacker.com/1504-exploits/safari-crossdomain.txt

Cookies Manager Author: Doddy Hackman A simple program in PHP to help with XSS vulnerability in this program are the following: [+] Cookie Stealer with TinyURL Generator [+] Can you see the cookies that brings back a page [+] Can create cookies with information they want [+] Hidden to login to enter Panel use ?poraca to find the login A video with examples of use: Download Source: https://github.com/DoddyHackman/Cookies_Manager

Consumers, hardware makers and even governments have never been more concerned about spying than they are today. It’s pretty much a given that most of the world’s superpowers have elaborate surveillance programs in place to monitor what we do online but who else is tracking your browsing? Internet marketing service NeoMam Studios recently put together a nice infographic on the topic that looks into who tracks browsing habits as well as the steps you can take to limit such activity in various browsers. Sursa:

Utilizatorii sistemului de operare Linux pot interzice definitv stocarea de cookie-uri Adobe's Flash Player. Este o idee buna din cauza faptului ca Flash Player ca plugin, nu detecteaza cand browserul web se afla in modul de navigare privat (Private Browsing mode). Ca si celelalte tipuri de cookie-uri web, multi dintre noi nu prea avem habar multi ce rol au si ce fac ele, dar un lucru este sigur: monitorizeaza si furnizeaza date despre navigarea pe web. Totusi, aceste cookie-uri Flash pot fi gasite si sterse. Si chiar interzise a fi stocate definitiv, daca folosim Linux. Se deschide o fereastra terminal si se foloseste comanda "su" pentru a avea acces superuser (root user status). Daca rulati Ubuntu sau alta distributie Linux ce foloseste ideea de acces de superutilizator, folositi doar prefixul "sudo" inaintea tuturor comenzilor. Pentru a gasi cookie-urile Flash Player in propriul sistem, utilizati comanda de cautare "find -iname '*.sol'" si va va aparea o lista cu o gramada de fisiere in subdirectorul "./.macromedia" din directorul "/home/userid". Cel mai probabil veti dori sa le stergeti pe toate, dar pentru a nu strica ceva, cel mai bine facem o salvare de siguranta. Folosim comanda "mkdir ./.macromedia.sav" si comanda "cp -a ./.macromedia/* ./.macromedia.sav/". Apoi putem sterge acel director si toate fisierele cookie Flash Player folosind "rm -rf ./.macromedia". Apoi, creeam o legatura intre acel director si directorul /dev/null cu comanda "ln -s /dev/null ./.macromedia", dupa care verificam legatura creata cu comanda "ls -al ./.macromedia" Ca rezultat ar trebui sa avem afisat pe ecran "./.macromedia -> /dev/null". Se lanseaza in executie browser-ul web si se navigheaza pe web catre un site unde putem vedea continut Flash si pentru a ne asigura ca putem viziona continutul. Pentru a putea reveni la situatia anterioara folosim: "mv ./.macromedia.sav ./.macromedia" si "chown userid:userid ./.macromedia", unde userid este ID-ul de utilizator al userului (altul decat root) pe care am facut incercarea. Daca totul e ok iar Flash Playerul nu "crapa", putem sterge salvarea de siguranta cu "rm -rf ./.macromedia.sav" pe care am facut-o mai devreme. Se poate face acelasi lucru si cu directorul "./.adobe/Flash_Player" daca acesta exista. O abordare similara a situatiei o putem face si cu Apple's Mac OS X, fiind conceput pe baza BSD Unix si care este similar cu Linux.

PARIS - France's data protection watchdog on Wednesday fined Google 150,000 euros ($205,000) -- the maximum possible -- for failing to comply with its privacy guidelines for personal data. The watchdog, the CNIL, also ordered the US Internet giant to publish a statement relating to its decision on its French homepage for at least 48 hours within the next eight days. Google was informed of the decision on January 3, the CNIL said in a statement. France's move follows Google's introduction in 2012 of a new privacy policy which enables it to track user activity across its search engine, Gmail, the Google+ social networking platform and other services it owns, which include YouTube. The changes make it easier for Google to collect and process data that could be used by advertisers to target individuals with tailored offers, thereby increasing the company's revenue potential. The CNIL had asked Google to inform web users in France on how it processes their personal data and to define exactly how long they can store the information. It had also requested that the US giant obtain user permission before storing cookies on their computers, referring to files that track web surfers and allow companies to target them with tailored commercials. Google has always maintained that its treatment of data gathered from users is in line with European law and has previously refused to get into an argument about the specific French requirements. The issue of data protection has gathered steam worldwide following revelations by Edward Snowden, a former contractor with the National Security Agency, that the US had a vast, secret program called PRISM to monitor Internet users. Google has defended the changes it made last year on the ground that they simplify and standardize its approach across its various services. But critics argue that the policy, which offers no ability to opt out aside from refraining from signing into Google services, gives the operator of the world's largest search engine unprecedented ability to monitor its users' tastes and purchasing patterns. Source: France Fines Google Maximum Penalty in Data Privacy Row | SecurityWeek.Com