mailing list archives
From: bugtraq () cgisecurity net
Date: Mon, 27 Nov 2006 20:28:12 -0500 (EST)
Mozilla with their XUL makes attackers life so much easier. It is not
that the Mozilla browser is vulnerable to any specific type of attack
but the past has already proved many times that eventually someone
will find an issue with the architecture. Then people will find the
same mistake in other places. The Mozilla XUL is considered a true RIA
(Rich Internet Application) platform that is currently the base of
(if installed) and Java (if installed). If the developers of these
applications don't have deep understandings of the security
implications of the Mozilla platform the WEB will become suddenly very
dangerous place for them.
Last but not least we have Microsoft with their XAML and WPF (Windows
Presentation Foundation). I am sure that not that many people have
heard of these technologies so let me explain what they are in brief.
They are the Microsoft's way to do RIA. The only thing is that they
relay on .NET3 which makes them explicitly for Windows. I am not sure
what is the state of the MONO project though.
WPF will allow you to build Rich Internet Applications with XML, CSS
to do some coding in ASP and you will see that it feels the same as
the desktop. It enables web worms and future high-end attackers to a
degree hardly imaginable by anyone today.
I've been waiting awhile to see someone talk about this! :)
It is good to hear some conversation about XUL and WPF/XAML as these kinds of applications/technologies will change
the way we use the web. For those who know nothing about these technologies picture a windows application running
inside of your browser having the same look/feel as a non web application (a pretty applet). One of the initial
the users inability to 'be aware of' application changes initiated potentially via XSS or other types of script
One could XSS a site, change the URL to the sites RIA application to their own, and potentially act as a proxy with
the real application without the users knowledge. Does anyone know of any decent links/tutorials on signing
to prevent such situations?
One of the neat .NET 3.0 features allows a developer to at compile time decide if an application is web based or
for those of you who have written applets instead of modifying code you just change a compile time option.
"Finally, it is worth noting that Windows executables can be hosted in a window (by default) as well as in the browser.
In both cases, the code remains the same and only needs to be compiled again with a different project property.
Additional reading for those interested
http://www.cgisecurity.com Website Security news and more!
http://www.cgisecurity.com/index.rss [RSS Feed]