Anatomy of a "feature" - what happens if a website grabs all your disk space?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

HTML5 allows websites to save data on your hard disk for the next time you visit.

Much like cookies, only different.

The cookie system in HTTP has two big disadvantages compared to what's generally referred to in HTML5 as Web Storage.

Firstly, cookies are wastefully sent in the HTTP headers of every request made back to the server that set the cookie in the first place.

Secondly, cookies are limited in size, mainly because of the first reason, to about 4KBytes.

In the modern, data-rich web, that doesn't leave much room to manoeuvre.

The Web Storage system, however, is driven by JavaScript, not by HTTP headers, and is actually surprisingly simple to use.

You just add attributes to the localStorage JavaScript variable inside the browser, and read them back later.

The official W3C standards document offers an example like this:

You have viewed this page an untold number of time(s).

The value localStorage.pageCount is used to keep track of how many times you have visited the page, even from one browser session to another, and setting the document.getElementById().textContent attribute makes the counter appear in the page itself.

For security reasons, each domain gets its own localStorage object, so that data can't leak from one site to another, and for safety reasons, the size of each object is limited.

? Web Storage also comes in the form of sessionStorage. Each browser window gets its own sessionStorage variable, and, as the name implies, all the values in it are lost when the session ends.

Each domain gets somewhere between 2.5MBytes (Chrome) and 10MBytes (IE) of localStorage to use.

However, as blogger Todd Anglin noted back in 2011:

Some browsers have exposed a workaround that grants "a1.website.com" and "a2.website.com" their own 5MB LocalStorage quotas.

Anglin saw this as a viable way around the quota limit, but also pointed out that:

[this] is specifically frowned upon in the HTML5 Web Storage spec. Browser authors are asked to prevent multiple sub-domains of a single site from being given a bigger localStorage pool.

Anglin therefore advised against this bodge to boost your storage size because it was "likely to break in future."

But Stanford student Feross Aboukhadijeh recently found that for most mainstream browsers, Anglin's future still lies ahead of us.

You can still bag extra localStorage using the multiple sub-domain trick.

Indeed, Aboukhadijeh created a web page by means of which you can inflict this trick on yourself, and the results are dramatic.

He can quickly grab gigabytes of your disk space by getting you to visit his one-off domain.

That might not sound like much of a Denial of Service (DoS) attack, but it's not supposed to happen, for obvious reasons.

And that's what really matters: that browsers (and network programmers in general) don't always take specifications seriously.

By the way, Firefox users can relax: your browser already applies a 5MByte limit at the domain level.

Aboukhadijeh says he's reported this bug, together with his practical demonstration of how easy it is to abuse, to the other browser vendors.

Let's see how long they take to respond, if indeed they consider it a problem worth fixing.

Follow @duckblog

View the original article here

Malware found sucking up data on new Japanese space agency rocket

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Japan’s space agency said on Friday that it found a computer virus on one of its desktop computers that was stealing data on one of its newest rockets and beaming it to controllers outside the agency, the New York Times reported.

The Japan Aerospace Exploration Agency (JAXA) said in a statement that the virus was found in a computer at its Tsukuba Space Center, northeast of Tokyo.

JAXA said anti-virus software detected the bug on November 21st, after which it conducted an emergency sweep for viruses that showed no other infected computers at the center.

The agency isn't sure whether the virus constitutes a cyberattack. But as the New York Times notes, Japanese defense companies have recently been targeted by similar data-siphoning Trojans, some traced to China.

Thieves this time around made off with data about the Epsilon, a solid-fuel rocket with artificial intelligence that Japan plans to send on its virgin flight in 2013.

The artificial intelligence will allow it to be remotely controlled by desktop computer.

This recent infection is the latest in a string of data pilfering targeting JAXA.

In January, the agency discovered a Trojan on an employee's computer that may have slurped login credentials for a cargo shuttle that carries food and equipment to the International Space Station (ISS).

Before the January incident, back in August 2011, JAXA found malware that after an employee opened an infected email attachment. JAXA immediately snatched the computer offline and scrubbed it clean - or, at least, that's what the agency thought.

But the computer stayed quirky, with JAXA describing it as "unstable" and prone to displaying "abnormalities".

JAXA engineers discovered the second virus on January 6th. This one was grabbing information and beaming it out to controllers between July 6th and August 11th.

JAXA said at the time that it immediately changed passwords and began checking other terminals, bolting down information security and working to ensure the leak would never recur.

It's unknown whether the current data leak came from these initial two viruses.

One thing we do know: JAXA is far from the only space agency-related target.

In November 2011, a Romanian man was arrested for hacking into NASA servers starting December 2010.

Earlier still, in 2008 a worm made it to the International Space Station, carried on a memory stick by an astronaut.

It's odd to think about rocket scientists muffing up the most elemental of security precautions, but there you have it: an employee clicks on an infected attachment, an astronaut plugs in a memory stick infected with creepy-crawlies, and then too, only last month an unencrypted NASA laptop was stolen when thieves broke into a car.

Full disk encryption, not clicking on unexpected email attachments, and scanning portable USB drives can go a long way toward avoiding data loss.

It's not rocket science, but then again, after all, rocket scientists are just human.

Follow @LisaVaas
Follow @NakedSecurity

Rocket image courtesy of Shutterstock

Tags: breach, epsilon, Full Disk Encryption, Hacker, hacking, Hacks, International Space Station, ISS, Japan, JAXA, Malware, NASA, space station, Trojan, Virus

View the original article here

Android malware poses as Angry Birds Space game

Over 100,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Android malware authors have seized an opportunity to infect unsuspecting smartphone users with the launch of the latest addition to the immensely popular "Angry Birds" series of games.

SophosLabs recently encountered malware-infected editions of the "Angry Birds Space" game which have been placed in unofficial Android app stores. Please note: The version of "Angry Birds Space" in the official Android market (recently renamed "Google Play") is *not* affected.

The Trojan horse, which Sophos detects as Andr/KongFu-L, appears to be a fully-functional version of the popular smartphone game, but uses the GingerBreak exploit to gain root access to the device, and install malicious code.

The Trojan communicates with a remote website in an attempt to download and install further malware onto the compromised Android smartphone.

Interestingly, the malware hides its payload - in the form of two malicious ELF files - at the end of a JPG image file.

With the malware in place, cybercriminals can now send compromised Android devices instructions to download further code or push URLs to be displayed in the smartphone's browser.

Effectively, your Android phone is now part of a botnet, under the control of malicious hackers.

It feels like we have to keep reminding Android users to be on their guard against malware risks, and to be very careful - especially when downloading applications from unofficial Android markets.

http://twitter.com/gcluley

View the original article here

As SOPA closes in, hackers look to space for the answer - HEXUS

Each year, a gathering of hackers takes place in Germany, known as the Chaos Communication Congress. The four-day event, now located in Berlin, has been running since 1984 and in 2004 saw a record attendance of 4,230 participants. The congress provides lectures, workshops and discussions on technology, society and utopia.

The 28th Chaos Communication Congress (28C3), which ran with the motto "Behind enemy lines", took place just prior to the New Year, during which time, a scheme to launch satellites into orbit and develop ground stations for tracking was outlined, with the intention of forming a Hackerspace Global Grid, free of censorship and as a backup for hackers during natural or economic disaster. Activists claim that the increasing threat of censorship, such as the recent SOPA Act, had motivated the project, with activist Nick Farr calling out for support for the project in August "The first goal is an uncensorable internet in space. Let's take the internet out of the control of terrestrial entities."

The project is currently in the stage of developing its knowledge-base and understanding, certain limitations must be worked with; typically amateur projects involve sending satellites into low-Earth orbit with balloons, however in non-standard orbits and orbits not situated around the equator, satellites travel quickly around the earth in a non-fixed manner, making them difficult to track. Step one of the project will involve the development of affordable and portable base stations for use in tracking satellite positions.

Mr Farr claims that the project's "only motive" behind the Hackerspace Global Grid is knowledge, "Hackers are about open information ... we believe communication is a human right."

Others question the potential use of such a network as a way to bypass measures implemented to block distribution of intellectual property and copyrighted materials. Whilst the practical usage of such a network remains to be seen, it has raised the question of space rights, though a satellite in orbit would fall under no country's jurisdiction, like-wise no international law exists to protect said satellite from aggressive measures from any country or entity.

An interesting project indeed and a most amazing feat should the community succeed in reaching its goals. We only hope that such satellites are able to remain in orbit without becoming victim to laser fire from a large firm or country.

View the original article here

Hackers prepare space satellites

30 December 2011 Last updated at 11:25 ET By David Meyer Technology reporter 50 years after Russia's first piloted mission, hackers plan to send their own people beyond orbit Computer hackers plan to take the internet beyond the reach of censors by putting their own communication satellites into orbit.

The scheme was outlined at the Chaos Communication Congress in Berlin.

The project's organisers said the Hackerspace Global Grid will also involve developing a grid of ground stations to track and communicate with the satellites.

Longer term they hope to help put an amateur astronaut on the moon.

Hobbyists have already put a few small satellites into orbit - usually only for brief periods of time - but tracking the devices has proved difficult for low-budget projects.

The hacker activist Nick Farr first put out calls for people to contribute to the project in August. He said that the increasing threat of internet censorship had motivated the project.

"The first goal is an uncensorable internet in space. Let's take the internet out of the control of terrestrial entities," Mr Farr said.

Beyond balloons

He cited the proposed Stop Online Piracy Act (Sopa) in the United States as an example of the kind of threat facing online freedom. If passed, the act would allow for some sites to be blocked on copyright grounds.

Whereas past space missions have almost all been the preserve of national agencies and large companies, amateur enthusiasts have in recent years sent a few payloads into orbit.

Continue reading the main story

This [hacker] community can put humanity back in space in a meaningful way”

End Quote Nick Farr Hackerspace Global Grid project These devices have mostly been sent up using balloons and are tricky to pinpoint precisely from the ground.

According to Armin Bauer, a 26-year-old enthusiast from Stuttgart who is working on the Hackerspace Global Grid, this is largely due to lack of funding.

"Professionals can track satellites from ground stations, but usually they don't have to because, if you pay a large sum [to send the satellite up on a rocket], they put it in an exact place," Mr Bauer said.

In the long run, a wider hacker aerospace project aims to put an amateur astronaut onto the moon within the next 23 years.

"It is very ambitious so we said let's try something smaller first," Mr Bauer added.

Ground network

The Berlin conference was the latest meeting held by the Chaos Computer Club, a decades-old German hacker group that has proven influential not only for those interested in exploiting or improving computer security, but also for people who enjoy tinkering with hardware and software.

When Mr Farr called for contributions to Hackerspace, Mr Bauer and others decided to concentrate on the communications infrastructure aspect of the scheme.

Mr Bauer says the satellites could help provide communications to help put an amateur into space

He and his teammates are working on their part of the project together with Constellation, an existing German aerospace research initiative that mostly consists of interlinked student projects.

In the open-source spirit of Hackerspace, Mr Bauer and some friends came up with the idea of a distributed network of low-cost ground stations that can be bought or built by individuals.

Used together in a global network, these stations would be able to pinpoint satellites at any given time, while also making it easier and more reliable for fast-moving satellites to send data back to earth.

"It's kind of a reverse GPS," Mr Bauer said.

"GPS uses satellites to calculate where we are, and this tells us where the satellites are. We would use GPS co-ordinates but also improve on them by using fixed sites in precisely-known locations."

Mr Bauer said the team would have three prototype ground stations in place in the first half of 2012, and hoped to give away some working models at the next Chaos Communication Congress in a year's time.

They would also sell the devices on a non-profit basis.

"We're aiming for 100 euros (£84) per ground station. That is the amount people tell us they would be willing to spend," Mr Bauer added.

Complications

Experts say the satellite project is feasible, but could be restricted by technical limitations.

"Low earth orbit satellites such as have been launched by amateurs so far, do not stay in a single place but rather orbit, typically every 90 minutes," said Prof Alan Woodward from the computing department at the University of Surrey.

Continue reading the main story

Any country could take the law into their own hands and disable the satellites”

End Quote Prof Alan Woodward Surrey University "That's not to say they can't be used for communications but obviously only for the relatively brief periods that they are in your view. It's difficult to see how such satellites could be used as a viable communications grid other than in bursts, even if there were a significant number in your constellation."

This problem could be avoided if the hackers managed to put their satellites into geostationary orbits above the equator. This would allow them to match the earth's movement and appear to be motionless when viewed from the ground. However, this would pose a different problem.

"It means that they are so far from earth that there is an appreciable delay on any signal, which can interfere with certain Internet applications," Prof Woodward said.

"There is also an interesting legal dimension in that outer space is not governed by the countries over which it floats. So, theoretically it could be a place for illegal communication to thrive. However, the corollary is that any country could take the law into their own hands and disable the satellites."

Need for knowledge

Apart from the ground station scheme, other aspects of the Hackerspace project that are being worked on include the development of new electronics that can survive in space, and the launch vehicles that can get them there in the first place.

Until now launching communications satellites has proved to be too expensive for amateur groups

According to Mr Farr, the "only motive" of the Hackerspace Global Grid is knowledge.

He said many participants are frustrated that no person has been sent past low Earth orbit since the Apollo 17 mission in 1972.

"This [hacker] community can put humanity back in space in a meaningful way," Farr said.

"The goal is to get back to where we were in the 1970s. Hackers find it offensive that we've had the technology since before many of us were born and we haven't gone back."

Asked whether some might see negative security implications in the idea of establishing a hacker presence in space, Farr said the only downside would be that "people might not be able to censor your internet".

"Hackers are about open information," Farr added. "We believe communication is a human right."

View the original article here