Hi Everyone - I'm here today to talk about HTML5.
Personally, I think the world wide web is awesome - its the reason I love security. And more and more devices are simply designed to get you onto the web as quick and as easily as possible, the rest is just extra bells and whistles. And HTML5 is about the make the web a whole lot more awesome!
HTML5 is a whole bunch of new standards, so its not a new version as you would be familiar with when it comes to some piece of software. In fact a lot of the technologies I will talk about (such as Geolocation for example) are not technically part of HTML5, but we're going to throw them all under the same umbrella - because they all make the web a cooler place
So - Today I am going to talk to you about 3 things ...

HTML5 Canvas

<canvas id="canvas" width="838" height="220"></canvas>

<script>
  var canvasContext = document.getElementById("canvas").getContext("2d");
  canvasContext.fillStyle= "red";
  canvasContext.fillRect(250, 25, 150, 100);
  
  canvasContext.fillStyle= "blue";  
  canvasContext.beginPath();
  canvasContext.arc(450, 110, 100, 0, Math.PI * 2, false);
  canvasContext.fill();
</script>

Cooler Canvas example

Has anyone here ever played Doom or Quake? I used to love those games in college. In fact Quake 2 was the first time I ever upgraded a PC just so that I could play a game!
Now though thanks to some awesome work by these 3 Googlers you can play it in your browser. Lets have a look
Remember everything here is rendered in the browser (15s). This really shows off the power of graphics in HTML5 (18s). Also all of the original audio from the game is in there too (unmute).
Another thing to realise here is that this game is played across the network using a new feature called WebSockets (37s), so networking is taking place in realtime - there are no AJAX style shenanigans going on. The game is also fully multiplayer and all save games are actually stored in the Browsers Local Storage - so you can start your game where you last left it.
Now I'm not sure how many of you guys are Quake fans, but I think the potential here is pretty obvious. There are already people looking at next-gen consoles where all the hard processing is done in the cloud, and the graphics are served up to the user on a thin client, for example

<video id="video" src="movie.mp4" autoplay controls></video>
document.getElementById("video").play();

The eagle eyed among you will have noticed that I already sneaked in the 2nd of my 5 favourite HTML5 features - the ease with which you can embed videos. This used to be a real pain in the past - you would need to either use a bunch of embed tags, or upload the video to Youtube and link it in that way. Considering the amount of videos online, its really surprising that it was this clunky. Now it couldn't be simpler
You can also add cool effects, and control it in different ways - because its really well integrated with the DOM. Pretty neat right?
Another aspect of modern web usage is that we don't just access it from Desktops anymore - heck a lot of the time we don't even use it from one of these (laptop). Nowadays we are on the move the whole time, and do a lot of our surfing on one of these (phone) or an iPad etc. That leads to some interesting new ideas...

The 3rd feature that is going to make a big change is Geolocation. Once you know where someone is, it opens up buckets of possibilities - different functionality based on the region, targeted ads, even games you can play in real world space. For example there is code out there to play Pacman in the real world - as you move around your phone tracks your location using the HTML5 geolocation API. How people do not get run over doing this I don't know, but it sound like fun.
Lets try it out - first it asks my permission, which is nice of it :)Then bingo - pretty accurate. In this case my browser is working out my location based on my IP address - so its not terribly accurate. But on my mobile (flip across) its much more accurate.

Drag and Drop

Drag to Download:

Drop in images from desktop

So those are some of the features that I personally think are going to make a big change to the web - new Graphics capabilities, easier Video, Geolocation, and Drag and Drop - of course that was only four features, and I promised you 5 features. The last one we will look at are Web Notifications [POPUP1]
This new feature allows you to create little popups outside of the browser, just like this one. Of course you can use these for more than just to remind you that you forgot something in your presentation - these are perfect for apps like email, twitter, social networks [POPUP2]
I think all of these features are going to make a massive difference to the way that we interact with the web.
So then...lets move onto how attackers can use HTML5. The fact is there are lots of ways attackers can abuse HTML5 - in fact so many I've written a paper on it, which I'll put a link up to at the end.
So - how bad does it get. A lot of the attacks are low-level and best explained with code in the paper, so instead of that - lets put together a full, real world, attack scenario, to see what a full attack can look like.

First the hacker needs to find as much details about the target, Bravo Ltd, as possible. From his personal experience he has found that large corporations have few holes on their network perimeter, so he started by first targeting the weakest link � the employees.
The attacker profiled many public sites such as LinkedIn, Facebook, Google+ and built up profiles on each publically available Bravo employee. While reading through forum posts from one of the companies IT guys, he finds out the company have a wide array of different OS � Windows, Linux, and Mac are all present, as well as Android and iPad/iPhone devices. So he chooses to use JavaScript as the common language for the attack
He also noticed that 10 of the employees are all regular members of a particular forum for vintage car owners, which appears to have some security issues � and chooses this as the initial attack vector.

XSS

<video><source onerror="javascript:alert(1)">

<input onfocus=alert(1) autofocus>

<body onscroll=alert(1)><br><br><br><br><br><br>...<br><br><br><br><input autofocus>

A lot of sites today try to prevent XSS by blacklisting certain HTML tags such as script or img. When it comes to protecting against XSS, blacklisting is actually a pretty crappy approach - but it still used a lot. But unless you update your blacklists to stop the various new XSS attacks that HTML5 introduces, you are still vulnerable
There are actually a bunch of new XSS attacks and the site html5sec.org keeps a really good list of them. Some are based on new tags, such as the video tag - which will not show up in older blacklist code
Others make use of the new autofocus attribute to trigger javascript. This can also be combined with other attributes like onscroll
Of course our attackers wants to do a lot more that display a simple alert popup...

Instead of having to code up everything himself, he can simply use an existing toolkit like the "Shell of the Future" tool from Indian researchers at Attack & Defense labs which is entirely written in JavaScript, and which creates a sort of man in the browser attack.
With this tool injected via XSS, the hacker can instruct the victims machines to invisibly browse the internet, in the context of the user. This means the attacker has the exact same access as the user would have to webmail accounts, intranet sites etc. Using this tool the attacker now has the perfect two way communication platform � he can issue a single command, and all 10 of the initial infected machines � regardless of whether they are Windows XP machines, or IPads - will carry out his command. It also barely touches the disk, and can easily be obfuscated - easily bypassing the AV scanner and IDS. Also the communication is all over web traffic - going straight through the companies firewalls
This is not the only such HTML5 shell of course - there are several other ones that make use of Cross-Origin Requests that you can find with a quick Google.

XMLHttpRequest()

Access-Control-Allow-Origin: *

http://www.gamblingSite.org/youraccount.php?race=1&horse=2&bet=1000

http://192.168.1.1:1234

The way the shell of the future tool works is by making use of the new Websockets and Cross-Origin Requests features of HTML5. Who here can tell me what the XMLHttpRequest function does?
In the past it allowed you to request content from a site via HTTP. However it was subject to the same origin policy. But in HTML5 there has been a slight change made here. You can now send a request to ANY domain, but you can only read from sites that specifically allow you to - which they can do using the "Access-Control-Allow-Origin:" response header
This allows for some new attacks though - the first is that only the reading of the response is now restricted, nothing will stop the browser making the request. This means that if you can do damage with a simple request, XHR is a big help. This is also very useful for scripting a DOS attack which we will show later on
Also XHR and Websockets allow you to connect to any site on almost port, so what does that allow us do (even if we can't read the response)? Well based on the amount of time it takes for the site to respond, it has been shown that this can be used as a port scanner

During their scanning, the hacker discovered an internal default home page, which points to the Intranet site http://myhome.bravo.com . While the companie�s Infosec team have done a pretty good job of hardening their external websites, this internal one is vulnerable to a SQL injection bug. The attacker orders one of his 10 initial victim�s browsers to exploit this bug, and install his attack script on the Intranet site. Within hours his number of infected users has risen from 10 people to almost the entire company.
This helps the attacker overcome the big draw back of a browser based botnet. While the bots are incredibly stealthy, and will bypass most traditional security mechanisms, as soon as the victim closes the browser the connection to the attacker is lost. Attackers need to factor this in as part of their botnet design � browser botnets will be used for tasks that are not reliant on being always on (such as spam, bitcoin mining, DDOS etc). However for all the benefits they give, this trade off is more than acceptable.
The hacker has now established two persistent re-infection vectors � the compromised car forum, and the compromised intranet site. Every time either of these are visited, the victim will rejoin the botnet. He also uses techniques such as Social Engineering, Clickjacking and Tabnabbing (both covered in the paper) to extend the lifetime that each bot remains online.
At this stage the attacker already has a pretty detailed layout of the victims network, but of course he can do more than that.

The last thing a hacker wants to do at this stage is to steal as much data as possible, and then dissapear. He can do this in lots of ways

As he is running in each victims browser, he browses invisibly to their webmail and internal mail accounts, is automatically logged in with the users cookies, and starts to harvest email information.

Also he can access any internal webservices he has found, such as internal customer databases or fileservers with a web frontend.
Those are traditional approaches however - Making use of new features in HTML5 he can:

Use hidden forms to steal personal data such as Credit card details, addresses, phone numbers, etc � using a new attack that makes use of the autocomplete feature
Using the new Web Notication API he can create specially crafted popups perfect for socially engineering the users into sending him login details, files and any other information he can think of.
And the attacker can even potentially use the new speech recognition available on systems running the Chrome browser to partially listen in on some user conversations.

That leaves only one thing left to do � disappearing without a trace... This could not be simpler. First he simply cleans up both infected servers, and then only needs to order all bots to disconnect from the network. He issues one final command - ordering all bots to close the tab containing the malicious code, and poof - he gone.

BITB

Botnets In the Browser

500

1

NOW WITH ADDED !!!

Move Around	← →
Zoom	CTRL/Command & +/-
Source File	s
Change Theme	t
Syntax Highlight	h
Speaker Notes	n
Toggle 3D	3
Help	0