Comments on: Insecure Content Ownership http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/?utm_source=rss&utm_medium=rss&utm_campaign=insecure-content-ownership Thoughts on Security in an Uncivilized World… Fri, 27 Apr 2012 13:53:43 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: kartheepan http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-730 kartheepan Tue, 03 Feb 2009 08:15:09 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-730 hi is it possible to restict the request for the resource jar file for applet loading.because we can use the jar file anywhere in our website by calling from applet archive.Hence is there any possiblity for validation of user ownership to verify and provide the jar file in response. hi is it possible to restict the request for the resource jar file for applet loading.because we can use the jar file anywhere in our website by calling from applet archive.Hence is there any possiblity for validation of user ownership to verify and provide the jar file in response.

]]> By: Rupesh http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-709 Rupesh Mon, 15 Dec 2008 07:49:22 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-709 Hi, Is it possible to share the trickery behind this exploit ? Im wrkin as an application security consultant. I would love to hear more on such explots. Regards, Rupesh Hi,

Is it possible to share the trickery behind this exploit ? Im wrkin as an application security consultant. I would love to hear more on such explots.

Regards,
Rupesh

]]> By: wheelq http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-650 wheelq Tue, 23 Sep 2008 09:18:36 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-650 Hi, is it possible to reveal the code of a jar file? I'm a beginner in java and I don't know how to read the values from the page that is loading the jar/ class file Hi,

is it possible to reveal the code of a jar file? I’m a beginner in java and I don’t know how to read the values from the page that is loading the jar/ class file

]]> By: rob http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-361 rob Wed, 09 Apr 2008 20:49:28 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-361 brilliant. i love it when these types of technologies attempt to infer what you were trying to do. brilliant. i love it when these types of technologies attempt to infer what you were trying to do.

]]> By: blafra » Blog Archive » Content Ownership and Validating File Types http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-360 blafra » Blog Archive » Content Ownership and Validating File Types Wed, 09 Apr 2008 02:47:10 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-360 [...] was referred to Billy (BK) Rios’s blog as an article there somewhat relates to research I conducted on how browsers react when faced with [...] [...] was referred to Billy (BK) Rios’s blog as an article there somewhat relates to research I conducted on how browsers react when faced with [...]

]]> By: Vladimir http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-359 Vladimir Tue, 08 Apr 2008 20:36:51 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-359 wow, that really is a huge vulnerability in many modern systems, i dont see it being patched anytime soon. wow, that really is a huge vulnerability in many modern systems, i dont see it being patched anytime soon.

]]> By: pbnetworks » Blog Archive » Insecure Content Ownership via Google code http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-358 pbnetworks » Blog Archive » Insecure Content Ownership via Google code Tue, 08 Apr 2008 15:20:54 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-358 [...] Read more at his blog [...] [...] Read more at his blog [...]

]]> By: How hosting foreign files risks your users security « BroddlIT http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-357 How hosting foreign files risks your users security « BroddlIT Mon, 07 Apr 2008 22:25:56 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-357 [...] , Java , Security Tags: Google Code, Security Hole I found this interesting post about a security hole in Google Code. Its quite complex, though the post is written very well, so you’ll be able to get the point [...] [...] , Java , Security Tags: Google Code, Security Hole I found this interesting post about a security hole in Google Code. Its quite complex, though the post is written very well, so you’ll be able to get the point [...]

]]> By: Blake Frantz http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-356 Blake Frantz Mon, 07 Apr 2008 18:42:45 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-356 April 4th, 2008 at 11:11 am xssniper said: ... foo: It’s not that simple, depending on the content-disposition and the content-type returned by the Google Server, the HTML page wouldn’t be rendered by the browser, it would merely present a download prompt. Luckly, both Flash and Java pretty much ignore the content-type and content-disposition headers (file extension as well). I’ve got another item thats right up your alley though and I’ll discuss it in a later post. ... I've conducted some initial research on how browsers respond to various content-type, disposition, and content combinations. Results can be found here: http://www.leviathansecurity.com/pdf/Flirting%20with%20MIME%20Types.pdf Feedback welcome. April 4th, 2008 at 11:11 am

xssniper said:
…
foo: It’s not that simple, depending on the content-disposition and the content-type returned by the Google Server, the HTML page wouldn’t be rendered by the browser, it would merely present a download prompt. Luckly, both Flash and Java pretty much ignore the content-type and content-disposition headers (file extension as well). I’ve got another item thats right up your alley though and I’ll discuss it in a later post.

…

I’ve conducted some initial research on how browsers respond to various content-type, disposition, and content combinations. Results can be found here:

http://www.leviathansecurity.com/pdf/Flirting%20with%20MIME%20Types.pdf

Feedback welcome.

]]> By: xssniper http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/comment-page-1/#comment-354 xssniper Mon, 07 Apr 2008 15:13:53 +0000 http://xs-sniper.com/blog/2008/04/04/insecure-content-ownership/#comment-354 @Venom23: The jar file is not local, it was uploaded to the code.google.com server. There was some trickery involved as when the JVM makes the request for the CLASS file found in the CODE attribute, it encodes portions of the request. The ARCHIVE attribute doesn't have this problem. Hosting applets on your domain can be a problem if you expose the wrong functionality. Java's same origin policy works in a way that allows the applet to communicate with the server that served the applet. So, if you have a URLConnection object that accepts arbitrary URLs in your applet..... you're asking for trouble. It's a good point, I may put out some more information about the differences between various Same Origin Policies and some of the nuances of each. @Venom23: The jar file is not local, it was uploaded to the code.google.com server. There was some trickery involved as when the JVM makes the request for the CLASS file found in the CODE attribute, it encodes portions of the request. The ARCHIVE attribute doesn’t have this problem.

Hosting applets on your domain can be a problem if you expose the wrong functionality. Java’s same origin policy works in a way that allows the applet to communicate with the server that served the applet. So, if you have a URLConnection object that accepts arbitrary URLs in your applet….. you’re asking for trouble. It’s a good point, I may put out some more information about the differences between various Same Origin Policies and some of the nuances of each.

]]>