[WEB SECURITY] Imposter v0.9 download. Two whitepapers on file stealing using IE and attacking Google Gears released.

[Lavakumar Kuppan <lava@xxxxxxxxxxx>]

--0016e68dbb71fb912b0480d6bc29
Content-Type: text/plain; charset=ISO-8859-1

Hello,

Recently I have been speaking in a few conferences about browser phishing
attacks. These attacks are performed against the browser and require no user
interaction.


Some of the attack highlights are:

1) Can steal files from the local file system of Internet Explorer users.

2) Can steal client-side databases including the Gmail and MySpace Inbox of
Google Gears user's.

3) Can place 7 different types of permanent backdoors in the browsers of
Google Gears users.

4) Can steal the passwords stored in FireFox (similar to Karmetasploit)



I am releasing two whitepapers detailing these attacks:

1) Flash + IE = Prison Break -
http://andlabs.org/whitepapers/F_IE_PrisonBreak.pdf

    Explains how a flash file running inside Internet Explorer can read from
the local file system of the victim and transfer it to the attacker.

 2) Google Gears for Attackers -
http://andlabs.org/whitepapers/GoogleGears_for_Attackers.pdf

    Explains the different kinds of data stealing and backdoor placing
attacks that can be performed against Google Gears. It also has details
about what is probably the first publicly released Persistent XSS
vulnerability based on Google Gears. This vulnerability is on MySpace.



I am also releasing Imposter which is a tool to perform these and other
similar attacks. It has an internal DNS server, Web Server and SMB packet
Sniffer.

The attacks performed by Imposter are:

1) Steal files from the victim's local file system

2) Steal data from Google Gears database

3) Place backdoors in Google Gears ResourceStores and ManagedResourceStores

4) Steal passwords from FireFox's password store

5) Steal cached files from the victim's browser

6) Poison the victim's browser cache.

7) Steal and set cookies in the victim's browser

8) Steal LocalSharedObjects from the victim's browser


Imposter can be downloaded from http://andlabs.org/tools.html#imposter


I hope you find this information interesting and useful. All comments and
suggestions are welcome.


Cheers,

Lava

Attack and Defense Labs

http://www.andlabs.org

--0016e68dbb71fb912b0480d6bc29
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<p class=3D"MsoNormal">Hello,</p>

<p class=3D"MsoNormal">Recently I have been speaking in a few conferences a=
bout
browser phishing attacks. These attacks are performed against the browser a=
nd
require no user interaction.</p>

<p class=3D"MsoNormal"><br></p><p class=3D"MsoNormal">Some of the attack hi=
ghlights are:</p>

<p class=3D"MsoNormal">1) Can steal files from the local file system of Int=
ernet
Explorer users.</p>

<p class=3D"MsoNormal">2) Can steal client-side databases including the Gma=
il and
MySpace Inbox of Google Gears user&#39;s.</p>

<p class=3D"MsoNormal">3) Can place 7 different types of permanent backdoor=
s in the
browsers of Google Gears users.</p>

<p class=3D"MsoNormal">4) Can steal the passwords stored in FireFox (simila=
r to Karmetasploit)</p>

<p class=3D"MsoNormal">=A0</p>

<p class=3D"MsoNormal">I am releasing two whitepapers detailing these attac=
ks:</p>

<p class=3D"MsoNormal">1) Flash + IE =3D Prison Break -
<a href=3D"http://andlabs.org/whitepapers/F_IE_PrisonBreak.pdf";>http://andl=
abs.org/whitepapers/F_IE_PrisonBreak.pdf</a></p>

<p class=3D"MsoNormal">=A0=A0 =A0Explains how a
flash file running inside Internet Explorer can read from the local file sy=
stem
of the victim and transfer it to the attacker.</p>

<p class=3D"MsoNormal">=A02) Google Gears for Attackers -
<a href=3D"http://andlabs.org/whitepapers/GoogleGears_for_Attackers.pdf";>ht=
tp://andlabs.org/whitepapers/GoogleGears_for_Attackers.pdf</a></p><p class=
=3D"MsoNormal">=A0=A0 =A0Explains the different kinds of data stealing and =
backdoor
placing attacks that can be performed against Google Gears. It also has det=
ails
about what is probably the first publicly released Persistent XSS vulnerabi=
lity
based on Google Gears. This vulnerability is on MySpace.</p>

<p class=3D"MsoNormal">=A0</p>

<p class=3D"MsoNormal">I am also releasing Imposter which is a tool to perf=
orm
these and other similar attacks. It has an internal DNS server, Web Server =
and
SMB packet Sniffer.</p>

<p class=3D"MsoNormal">The attacks performed by Imposter are:</p>

<p class=3D"MsoNormal">1) Steal files from the victim&#39;s local file syst=
em</p><p class=3D"MsoNormal">2) Steal data from Google Gears database</p>

<p class=3D"MsoNormal">3) Place backdoors in Google Gears ResourceStores an=
d
ManagedResourceStores</p>

<p class=3D"MsoNormal">4) Steal passwords from FireFox&#39;s password store=
</p>

<p class=3D"MsoNormal">5) Steal cached files from the victim&#39;s browser<=
/p>

<p class=3D"MsoNormal">6) Poison the victim&#39;s browser cache.</p>

<p class=3D"MsoNormal">7) Steal and set cookies in the victim&#39;s browser=
</p>

<p class=3D"MsoNormal">8) Steal LocalSharedObjects from the victim&#39;s br=
owser</p>

<p class=3D"MsoNormal"><br></p><p class=3D"MsoNormal">Imposter can be downl=
oaded from
<a href=3D"http://andlabs.org/tools.html#imposter";>http://andlabs.org/tools=
.html#imposter</a></p>

<p class=3D"MsoNormal"><br></p><p class=3D"MsoNormal">I hope you find this =
information interesting and useful. All
comments and suggestions are welcome.</p>

<p class=3D"MsoNormal"><br></p>

<p class=3D"MsoNormal">Cheers,</p>

<p class=3D"MsoNormal">Lava</p>

<p class=3D"MsoNormal">Attack and Defense Labs</p>

<p class=3D"MsoNormal"><a href=3D"http://www.andlabs.org";>http://www.andlab=
s.org</a></p>

--0016e68dbb71fb912b0480d6bc29--