GNUCITIZEN

The truth is that some things will never get picked up by the community unless you really start bragging about them. Repetition is a key element.

Obviously not an extremely devastating vulnerability but the issue, which I have reported here and also logged in Mozilla’s bugzilla 3 months ago, is still present and works quite well. This is yet another design bug which abuses the way browsers work rather then exploit a vulnerability within the software.

The issues is quite simple. [...]

So let’s say that you decide to write a tool for doing some web related exploitation, enumeration, etc. The preferred language of choice comes down to perl, python ruby (C if you are an old school diehard).

It has to run from the command line. It has to have flags, etc, etc, and pretty much everything else a command line tool usually needs. [...]

I heard of clickjacking a couple of weeks back when the media blast started. At that time a had a very vague idea what it was and just recently I saw some POCs coming out to show how it works in practice.

Clickjacking, if I may categorize it, falls into the category of GUI attacks. I associate the clickjacking attack with the focus stealing attack which allows attackers to steal any file from the disk as long as they trick the victim to type enough characters. [...]

The stuff I am about the discuss are not big deal but we should keep them in mind.

If you haven’t noticed yet, Google Chrome supports a bunch of command line options. You can get a listing of all command line options from chrome_switches.cc. Obviously, some of them look quite powerful. Is that a concern? Well, IMHO, I think so but there is no reason to panic just yet.

Why is this a concern? I will put it this way. [...]

Google Chrome is a fact. It is a nice and slick looking browser. It is open source and it has some nice security features. However, these security features strive to protect the user from attacks which try to takeover your browser and operating system. As I explained here, because nowadays most of the data is located on the Web, it makes sense to have built-in security features to prevent the various forms of information leaks, XSS, CSRF, etc. attacks as well. [...]

It is true what many of you have heard. Google is releasing their own browser. Google Chrome, as they call it, is based on WebKit rendering engine and introduces some novel approaches to interacting with web technologies. I must say, it is very exciting to see all of this happening.

What makes Google Chrome different is its architecture. The browser is no longer single-threaded process. Each tab is actually a separate process with own memspace. [...]

These are the stuff every guy, who has pocked the browser or the client-side lately, would like to hear about. Behold the File I/O the W3C spec for local file access.

Here is a description of what it does. The interesting part from the text bellow is outlined in bold:

I wonder which folder the typical user will select. Hmmm, the Desktop, My Documents? And where all these interesting files are? Mac OS X user, you’ve got a problem. Don’t mount the desktop. [...]

OK people, Adobe Apollo is out. Go grab your copy now. Keep in mind that this is the Alpha1 release so give it some time until it gets to at least beta.

For those who don’t know what Apollo is, here is my very short summary. Apollo is RIA (Rich Internet Application) framework that is based on the top of Flex. Java Webstart is also RIA although it does not provide the same functionalities as Apollo. [...]