Keylogging Threat Could Lead To More Attacks, Say Researchers

snoopy · Jan 6, 2012

Keylogging threat could lead to more attacks, say researchers

Security researcher Mario Heiderich reported to the maker of Firefox last year that he had found an unusual vulnerability in the browser and two other Mozilla products that run on the Gecko engine, Thunderbird, and SeaMonkey. Based in the relatively new technology that allows for animated complex vector graphics in the browser, called SVG animation, the vulnerability allowed for a malware writer to detect key strokes even when JavaScript was disabled.

Basically, he found a way to turn innocuous Web pages into keyloggers. Mozilla patched the vulnerability in Firefox 9, Thunderbird 9, and SeaMonkey 2.6. Then, as is standard operating procedure, they announced to the public what the threat was and that it had been fixed. But the real threat may lie in what the threat wasn't: it wasn't based in JavaScript.

"The basic premise of my research currently is scriptless attacks, meaning attack vectors working in a post-XSS world," Heiderich said in an e-mail. He defined a "post-XSS" world as one where the cross-site scripting attack had been more or less minimized by technologies like sandboxed iFrames, Mozilla's e-mail client Thunderbird and Firefox's Content Security Policy, the JavaScript blocking browser add-on NoScript, and Windows 8.
Click to expand...

Story here - http:/ ews.cnet.com/8301-1009_3-57353483-83/keylogging-threat-could-lead-to-more-attacks-say-researchers/

Log in or Sign up

Keylogging Threat Could Lead To More Attacks, Say Researchers

snoopy Registered Members

Share This Page

Log in or Sign up

Keylogging Threat Could Lead To More Attacks, Say Researchers

snoopy Registered Members

Share This Page

Useful Searches