Protecting the Intranet Against "JavaScript Malware" and Related Attacks

The networking functionality of JavaScript is restricted by the Same Origin Policy (SOP). However, as the SOP applies on a document level, JavaScript still possesses certain functionality for cross domain communication. These capabilities can be employed by malicious JavaScript to gain access to intranet resources from the outside. In this paper we exemplify capabilities of such scripts. To protect intranet hosts against JavaScript based threats, we then propose three countermeasures: Element Level SOP, rerouting of cross-site requests, and restricting the local network. These approaches are discussed concerning their respective protection potential and disadvantages. Based on this analysis, the most promising approach, restricting the local network, is evaluated practically. We’re entering a time when XSS has become the new Buffer Overflow and JavaScript Malware is the new shellcode. Jeremiah Grossman [6]

• Type: Conference
• Year: 2007
• Where: DIMVA
• Authors: Martin Johns, Justus Winter
• Keywords: Computer Networks, DIMVA 2007, Element Level SOP, Javascript, JavaScript Based Threats