[Full-disclosure] Imposter v0.9 download. Two whitepapers on file stealing using IE and attacking Google Gears released.

[Lavakumar Kuppan <lava@xxxxxxxxxxx>]

Hello,

Recently I have been speaking in a few conferences about browser phishing
attacks. These attacks are performed against the browser and require no user
interaction.


Some of the attack highlights are:

1) Can steal files from the local file system of Internet Explorer users.
2) Can steal client-side databases including the Gmail and MySpace Inbox of
Google Gears user's.
3) Can place 7 different types of permanent backdoors in the browsers of
Google Gears users.
4) Can steal the passwords stored in FireFox (similar to Karmetasploit)


I am releasing two whitepapers detailing these attacks:

1) Flash + IE = Prison Break -
http://andlabs.org/whitepapers/F_IE_PrisonBreak.pdf

    Explains how a flash file running inside Internet Explorer can read from
the local file system of the victim and transfer it to the attacker.

 2) Google Gears for Attackers -
http://andlabs.org/whitepapers/GoogleGears_for_Attackers.pdf

    Explains the different kinds of data stealing and backdoor placing
attacks that can be performed against Google Gears. It also has details
about what is probably the first publicly released Persistent XSS
vulnerability based on Google Gears. This vulnerability is on MySpace.

I am also releasing Imposter which is a tool to perform these and other
similar attacks. It has an internal DNS server, Web Server and SMB packet
Sniffer.

The attacks performed by Imposter are:
1) Steal files from the victim's local file system
2) Steal data from Google Gears database
3) Place backdoors in Google Gears ResourceStores and ManagedResourceStores
4) Steal passwords from FireFox's password store
5) Steal cached files from the victim's browser
6) Poison the victim's browser cache.
7) Steal and set cookies in the victim's browser
8) Steal LocalSharedObjects from the victim's browser

Imposter can be downloaded from http://andlabs.org/tools.html#imposter

I hope you find this information interesting and useful. All comments and
suggestions are welcome.

Cheers,
Lava
Attack and Defense Labs
http://www.andlabs.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/