Title: “Breaking Host Security: Real World Cross-Site Scripting”
Presenter: Alex Horan
Date: October 21st, 2009
Location: Hilton London Metropole U.K.
Abstract:
Most organizations have multiple classes of endpoints on their networks today, existing as either single purpose devices or assets that perform multiple functions. Desktops and laptops represent endpoint systems that are both powerful and complex, and those that are typically operated by users who are not particularly sensitive to today’s most relevant security challenges. As a result, most organizations actively configure and deploy endpoint security to help protect their operations and sensitive data.
This traditional security model is most often delivered via host-based security products such as anti-malware applications, firewalls and IDS/IPS software. What these measures have in common is that they are all design to limit the exposure of the device operating system to direct attempts from other machines to send malicious code or attacks to an endpoint to control or extract information from it. And by providing regular updates to the security tools, these defensive systems can help protect against emerging problems or newly-discovered vulnerabilities resident in these hosts’ operating systems, or third party applications running on the devices.
However, these defensive mechanisms also all make the same flawed assumption that an attack itself will always execute on the host, either after being sent across the network or retrieved/downloaded and run on the machine by the user. This line of thinking is particularly flawed based on the emergence of Cross-Site Scripting (XSS) attacks, which target vulnerabilities in Web servers and browsers rather than endpoint operating systems themselves.
In this talk we will update the definition of XSS attacks as we know them and illustrate how and why today’s cutting-edge XSS threats are finding plenty of defenseless victims to exploit. Further, we will outline the scope of malicious capabilities available to attackers once they have successfully delivered their XSS payloads, offering attendees a real-world view of today’s most prevalent and cutting-edge XSS attack models.
