NoScript for Mobile Devices

Monday, October 17th, 2011

This is the first feature-complete mobile version of NoScript. In other words, it provides all the major security features of its desktop counterpart which make sense on a mobile device. http://hackademix.net/2011/10/15/noscript-for-mobile-is-complete/

New URL Shortener Hijacks Browsers for DDoS

Tuesday, December 21st, 2010

In order to outline the dangers of implicitly trusting shortened URLs, a student has launched a service which generates links that take users to their destination, but also hijack their browsers for DDoS.  Called d0z.me, the service is the creation of Ben Schmidt (@supernothing307), a computer science major at University ...

evercookie

Friday, October 22nd, 2010

evercookie is a javascript API available that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they've removed standard cookies, Flash cookies (Local Shared Objects or LSOs), and others. evercookie accomplishes this by storing the cookie data in several types of storage mechanisms ...

Clientless SSL VPN Vulnerability

Tuesday, December 1st, 2009

Web browsers enforce the same origin policy to prevent one site's active content (such as JavaScript) from accessing or modifying another site's data. For instance, active content hosted at http:///page1.html can access DOM objects on http:///page2.html, but cannot access objects hosted at http:///page.html. Many clientless SSL VPN products retrieve content ...

Reddit Javascript Worm?

Sunday, September 27th, 2009

Well, all that URL-encoded text in the links evaluates to something functionally equivalent to this: nonsense = "[x][b]\n[b]:/[" + this.innerHTML + "](/=eval(unescape(this.innerHTML9371d7a2e3ae86a00aab4771e39d255d9371d7a2e3ae86a00aab4771e39d255d//)"; elements = document.getElementsByTagName('a'); for (i = 0; i < elements.length; i++) { if (elements[i].innerHTML == 'reply') ...