Comments on: Persistent Bi-directional Communication Channels http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/ Information Security Think Tank Sun, 23 Nov 2008 13:05:19 +0000 http://wordpress.org/?v=2.6.3 By: AttackAPI 0.8 is OUT | GNUCITIZEN http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-123990 AttackAPI 0.8 is OUT | GNUCITIZEN Fri, 10 Oct 2008 08:19:58 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-123990 [...] is currently available. That is important because the Web is very distributed and agile network and controlling dozens of infected clients is a mission on its [...] [...] is currently available. That is important because the Web is very distributed and agile network and controlling dozens of infected clients is a mission on its [...]

]]> By: Mobile Zombies, XSSWW, hack the planet? « RETURN $ecure; http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-70964 Mobile Zombies, XSSWW, hack the planet? « RETURN $ecure; Thu, 15 Nov 2007 03:00:21 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-70964 [...] using bi-directional persistent communication channels to control browsers isn’t anything new,  nor is the  concept of a Cross Site Scripting [...] [...] using bi-directional persistent communication channels to control browsers isn’t anything new,  nor is the  concept of a Cross Site Scripting [...]

]]> By: GNUCITIZEN » Carnaval http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-2436 GNUCITIZEN » Carnaval Tue, 16 Jan 2007 12:56:37 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-2436 [...] The project was announced on August 24th, 2006 in a post called “Introducing Carnaval”. The concept behind Carnaval’s channel interface is covered in the “Persistent Bi-directional Communication Channels” article in October 2nd, 2006. [...] [...] The project was announced on August 24th, 2006 in a post called “Introducing Carnaval”. The concept behind Carnaval’s channel interface is covered in the “Persistent Bi-directional Communication Channels” article in October 2nd, 2006. [...]

]]> By: indubitably… » Backframe JavaScript Attack Console http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-1219 indubitably… » Backframe JavaScript Attack Console Wed, 13 Dec 2006 18:09:48 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-1219 [...] Right now it is quite stable and it should work well with attack channels similar to the one described here: http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels [...] [...] Right now it is quite stable and it should work well with attack channels similar to the one described here: http://www.gnucitizen.org/blog.....n-channels [...]

]]> By: Backframe (Formerly Backweb) JavaScript Attack Console » http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-1197 Backframe (Formerly Backweb) JavaScript Attack Console » Wed, 13 Dec 2006 02:49:32 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-1197 [...] Persistent Bi-directional Communication Channels [...] [...] Persistent Bi-directional Communication Channels [...]

]]> By: GNUCITIZEN » Sploiter Splog http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-696 GNUCITIZEN » Sploiter Splog Sat, 18 Nov 2006 07:04:34 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-696 [...] Using the techniques such as persistent channels, backdoors in QuickTime, backdoors in Flash, backdoors in PDF, backdoors in RealMedia and backdoors in RSS feeds in conjunction with splogs one can achieve quite a lot. Sometimes I even scare myself when I start thinking more deeply about this problem. Moreover, I know that the process can be automated. Every flash file the sploger downloads can be altered; every sound, backdoored; every image, changed. It is not a war between the humans and the machines. It is a war between us and ourselves only. [...] [...] Using the techniques such as persistent channels, backdoors in QuickTime, backdoors in Flash, backdoors in PDF, backdoors in RealMedia and backdoors in RSS feeds in conjunction with splogs one can achieve quite a lot. Sometimes I even scare myself when I start thinking more deeply about this problem. Moreover, I know that the process can be automated. Every flash file the sploger downloads can be altered; every sound, backdoored; every image, changed. It is not a war between the humans and the machines. It is a war between us and ourselves only. [...]

]]> By: GNUCITIZEN » Backframe (0.1a) http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-500 GNUCITIZEN » Backframe (0.1a) Mon, 06 Nov 2006 03:22:47 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-500 [...] The application is in its 0.1a release currently. This means that a lot more work needs to be done. Right now it is quite stable and it should work well with attack channels similar to the one described here. Check the AttackAPI project for the attack channel complete source code. [...] [...] The application is in its 0.1a release currently. This means that a lot more work needs to be done. Right now it is quite stable and it should work well with attack channels similar to the one described here. Check the AttackAPI project for the attack channel complete source code. [...]

]]> By: GNUCITIZEN » Introducing Backweb http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-389 GNUCITIZEN » Introducing Backweb Mon, 30 Oct 2006 09:36:52 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-389 [...] The application is in its 0.1a release currently. This means that a lot more work needs to be done. Right now it is quite stable and it should work well with attack channels similar to the one described here. Check the AttackAPI project for the attack channel complete source code. [...] [...] The application is in its 0.1a release currently. This means that a lot more work needs to be done. Right now it is quite stable and it should work well with attack channels similar to the one described here. Check the AttackAPI project for the attack channel complete source code. [...]

]]> By: pdp http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-200 pdp Fri, 06 Oct 2006 01:32:24 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-200 Brad, very good point. I have a few more things to finish before going into this issue. I get the feeling that it is possible but than I again I've been wrong before, so you are right: the theory might not work in practice. Let's see. Brad, very good point. I have a few more things to finish before going into this issue. I get the feeling that it is possible but than I again I’ve been wrong before, so you are right: the theory might not work in practice. Let’s see.

]]> By: Brad Neuberg http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-194 Brad Neuberg Thu, 05 Oct 2006 12:58:47 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-194 The reason I say this is the devil is in the details when it comes to JavaScript Flash communication, so the theory might not work in practice (which Im hoping ;) The reason I say this is the devil is in the details when it comes to JavaScript Flash communication, so the theory might not work in practice (which Im hoping ;)

]]> By: pdp http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-188 pdp Thu, 05 Oct 2006 01:34:16 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-188 Hi Brad, I am planning to write hacked version of Flash Storage model soon. In this article I am presenting the technique and the theory behind it. Of course that is not sufficient. Soon there will be an examples as well and I am planning to do this in the 0.9 release of AttackAPI. Thanks for the comment. Hi Brad,

I am planning to write hacked version of Flash Storage model soon. In this article I am presenting the technique and the theory behind it. Of course that is not sufficient.

Soon there will be an examples as well and I am planning to do this in the 0.9 release of AttackAPI. Thanks for the comment.

]]> By: Brad Neuberg http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels/#comment-186 Brad Neuberg Wed, 04 Oct 2006 19:36:57 +0000 http://www.gnucitizen.org/blog/persistent-bi-directional-communication-channels#comment-186 This is interesting but I'd like to see an actual working example. My Dojo Storage flash code, for example, must be invoked and loaded on page load since it depends on a document.write; I'm not sure if a dynamic SCRIPT tag could invoke it and set it up. If the original domain already has Dojo Storage or the given flash file then that is one thing, but what if it doesn't? This is interesting but I’d like to see an actual working example. My Dojo Storage flash code, for example, must be invoked and loaded on page load since it depends on a document.write; I’m not sure if a dynamic SCRIPT tag could invoke it and set it up. If the original domain already has Dojo Storage or the given flash file then that is one thing, but what if it doesn’t?

]]>