Tool Turns Any JavaScript-Enabled Browser into a Malicious Drone

By Lisa Vaas Print this article Print

A new tool called Jikto can turn any PC or device with a browser into a site attacker.

A new tool too dangerous to give away can turn any PC—Windows, Mac, Linux—or any device with a browser into a site attacker.

The tool, called Jikto, is a Web application scanner that searches for cross-site scripting vulnerabilities. Billy Hoffman, a security researcher with SPI Dynamics, demonstrated what the tool could do at the ShmooCon hacker convention March 24. Namely, Jikto, which is written in JavaScript, can surreptitiously latch onto a browser that has JavaScript enabled.

After silently inserting itself to run inside any browser—be it that of a PC, a cell phone—Jikto can then search sites for cross-site scripting vulnerabilities and report its findings to a third party without the user of the infected browser being aware.

It can also replicate itself onto sites containing cross-site scripting vulnerabilities and then spread via latching onto visiting browsers, Hoffman told eWEEK in an interview.

This is something that JavaScript wasn't supposed to be able to do, but unfortunately, Hoffman said, it can.

JavaScript was originally Netscape's version of the ECMAScript standard, a scripting language based on the concept of prototype-based programming.

Now controlled by the Mozilla Foundation, JavaScript is best known for its client-side use in Web sites.

Read more here about cross-site scripting attacks.

In that context, a major use of JavaScript is to write functions that are embedded in HTML pages and which interact with the DOM (Document Object Model) of the page to do things that HTML can't do on its own: create pop-up windows, validate Web form input values or change images as a mouse cursor moves over them, for example.

Web application vulnerability scanners have been around some seven years. Most have been software installed on a PC.

Jikto, because it's written in JavaScript, doesn't need to be grounded on a client, Hoffman said.

"Your browser just visits a page. If it contains JavaScript, it can start scanning other sites for vulnerabilities," he said.

The ShmooCon audience, which contained members of Microsoft's Internet Explorer team and representatives from Mozilla—the makers of the FireFox browser—were "kind of shocked" to learn what the evil one can do with JavaScript, Hoffman said.

That's good, the security researcher said—"By getting them interested, we can use that to [heighten the awareness of the dangers of Web site vulnerabilities]."

As it is, over the past few years, security researchers have seen attackers doing much more with Web site vulnerabilities, particularly with cross-site scripting vulnerabilities, where attackers can inject JavaScript into a site, he said.

For example, instead of typing a message or a question on an online guestbook or forum, an attacker could insert JavaScript. The malicious HTML then downloads to a browser.

Examples of recent JavaScript exploits have included the Windows Live Italy search engine getting hit by a link bomb earlier in March, with some 95 percent of search results on "hot" keywords leading to malware and exploit sites.

Next Page: Other exploits

This article was originally published on 2007-03-26
Lisa Vaas is News Editor/Operations for eWEEK.com and also serves as editor of the Database topic center. Since 1995, she has also been a Webcast news show anchorperson and a reporter covering the IT industry. She has focused on customer relationship management technology, IT salaries and careers, effects of the H1-B visa on the technology workforce, wireless technology, security, and, most recently, databases and the technologies that touch upon them. Her articles have appeared in eWEEK's print edition, on eWEEK.com, and in the startup IT magazine PC Connection. Prior to becoming a journalist, Vaas experienced an array of eye-opening careers, including driving a cab in Boston, photographing cranky babies in shopping malls, selling cameras, typography and computer training. She stopped a hair short of finishing an M.A. in English at the University of Massachusetts in Boston. She earned a B.S. in Communications from Emerson College. She runs two open-mic reading series in Boston and currently keeps bees in her home in Mashpee, Mass.
eWeek eWeek

Have the latest technology news and resources emailed to you everyday.