Subscribe to our newsletters
Sign Up

The Hacker News — Cyber Security, Hacking, Technology News

Wednesday, May 09, 2018 Mohit Kumar

how-to-run-javascript-function-in-excel
Shortly after Microsoft announced support for custom JavaScript functions in Excel, someone demonstrated what could possibly go wrong if this feature is abused for malicious purposes.

As promised last year at Microsoft's Ignite 2017 conference, the company has now brought custom JavaScript functions to Excel to extend its capabilities for better work with data.

Functions are written in JavaScript for Excel spreadsheets currently runs on various platforms, including Windows, macOS, and Excel Online, allowing developers to create their own powerful formulae.

But we saw it coming:

Security researcher Charles Dardaman leveraged this feature to show how easy it is to embed the infamous in-browser cryptocurrency mining script from CoinHive inside an MS Excel spreadsheet and run it in the background when opened.
"In order to run Coinhive in Excel, I followed Microsoft’s official documentation and just added my own function," Dardaman said.
Here is an official documentation from Microsoft to learn how to run custom JavaScript functions in Excel.

But... JavaScript for Excel Poses Less Threat—Here's Why?

JavaScript in Excel
However, it should be noted that Excel add-ins, the APIs which are responsible for running the JavaScript custom functions, don’t execute by default immediately after opening the JS-embedded spreadsheet.

Instead, users need to manually load and run JavaScript functions through the Excel add-ins feature for the first time, and later it will get executed automatically every time the Excel file is opened on the same system.

Moreover, when you explicitly try to run a JavaScript function in Excel sheet that connects to an external server, Microsoft prompts the user to allow or deny the connection, preventing unauthorized code from executing.

Therefore, JavaScript for Excel does not pose much threat today, unless and until someone finds a way around to execute it automatically without requiring any user interaction.

Besides this, Microsoft has also confirmed that Excel add-ins currently rely on a hidden browser process to run asynchronous custom functions, but in the future, it will run JavaScript directly on some platforms to save memory.

For now, JavaScript custom functions for Excel has been made available in Developer Preview edition for Windows, Mac, iPads and Excel Online only to Office 365 subscribers enrolled in the MS Office Insiders program.

Microsoft will soon roll this feature out to a broader audience.

Sunday, April 20, 2014 Swati Khandelwal

Feedly Android App Javascript Injection vulnerability exposed Millions of Users to Hackers
When it comes to Android apps, even the simplest app could greatly compromise your privacy and security.

Injecting malicious JavaScript into Android applications has drawn an increased attention from the hacking community as its market share spikes. According to security researcher Jeremy S. from Singapore, a critical vulnerability in the Feedly app left millions of android app users vulnerable to the JavaScript infections.

Feedly is a very popular app available for iOS and Android devices, also integrated into hundreds of other third party apps, which offers its users to browse the content of their favourite blogs, magazines, websites and more at one place via RSS feed subscriptions. According to Google Play Store, more than 5 Million users have installed Feedly app into their Android devices.

In a blogpost, the researcher reported that Feedly is vulnerable to JavaScript injection attack, which is originally referred as 'cross-site scripting' or XSS vulnerability, allows an attacker to execute any JavaScript code on client-side. JavaScript is a widely used technology within the websites and web based applications, but it is use not only for the good purposes, but for the malicious purposes as well.

Feedly app was failed to sanitize the Javascript code written in the original articles on subscribed websites or blogs, that left millions of their feed subscribers open to the injection attacks. Researcher demonstrated that the vulnerability allows an attacker to execute the malicious JavaScript code within the Feedly app at the users’ end. So, if a user browses an article via Feedly that might include the malicious javascript code, the users unknowingly give leverages to an attacker to carry out malicious activities against themselves.
“The android app does not sanitize JavaScript codes and interprets them as codes. As a result, allows potential attackers to perform JavaScript code executions on victim's Feedly android app session via a crafted blog post,” the researcher wrote. He added, “Attacks can take place only when user browses the RSS-subscribed site's contents via the Feedly android app.”

A malicious JavaScript injection allows an attacker to do a number of things, to modify or read cookies, temporarily edit web page contents, to modify web forms, to inject tracking codes or exploits codes in order to infect the Android users.

He discovered the vulnerability on 10th March and reported it to Feedly, which was then acknowledged by them and fixed on 17th March 2014. But they didn't mention any vulnerability fix in their change logs on Google Play Store. So, the users who have not enabled automated updates from Play Store, should manually update installed Feedly app as soon as possible.

To Subscribe 'The Hacker News' latest updates via Feedly - Click Here.

Wednesday, September 13, 2017 Swati Khandelwal

tor-zero-day-exploits-hacking
It seems like Tor Browser zero-day exploits are in high demand right now—so much so that someone is ready to pay ONE MILLION dollars.

Zerodium—a company that specialises in acquiring and reselling zero-day exploits—just announced that it will pay up to USD 1,000,000 for working zero-day exploits for the popular Tor Browser on Tails Linux and Windows operating system.

Tor browser users should take this news an early warning, especially who use Tails OS to protect their privacy.

Zero-day exploit acquisition platform has also published some rules and payout details on its website, announcing that the payout for Tor exploits with no JavaScript has been kept double than those with JavaScript enabled.

The company has also clearly mentioned that the exploit must leverage remote code execution vulnerability, the initial attack vector should be a web page and it should work against the latest version of Tor Browser.

Moreover, the zero-day Tor exploit must work without requiring any user interaction, except for victims to visit a web page.

Other attack vectors such as delivery via malicious document are not eligible for this bounty, but ZERODIUM may, at its sole discretion, make a distinct offer to acquire such exploits.

Zerodium to Sell Tor Browser 0-Days to Law Enforcement Agencies


Although the zero-day market has long been a lucrative business for private firms that regularly offer more payouts for undisclosed vulnerabilities than big technology companies, Zerodium says that it wants to resell the Tor browser exploits to law enforcement agencies to fight crime.

In a FAQ, the company has admitted that it will sell the acquired Tor zero-days to law enforcement agencies, and possibly the commercial malware development companies who sell spyware to governments.
"In many cases, [Tor] used by ugly people to conduct activities such as drug trafficking or child abuse. We have launched this special bounty for Tor Browser zero-days to help our government customers fight crime and make the world a better and safer place for all," Zerodium said.
In response to the Zerodium bounty program, Tor Project says that breaching the security of its anonymity software may risk lives of many users, including human rights defenders, activists, lawyers, and researchers, who rely on it.

The non-profit foundation also urges researchers and hackers to responsibly disclose vulnerabilities in Tor via its recently-launched bug bounty program.
"We think the amount of the bounty is a testament to the security we provide. We think it's in the best interest of all Tor users, including government agencies, for any vulnerabilities to be disclosed to us through our own bug bounty," Tor Project spokesperson told The Hacker News.
"Over 1.5 million people rely on Tor everyday to protect their privacy online, and for some it's life or death. Participating in Zerodium's program would put our most at-risk users' lives at stake."

Payouts for Tor Browser 0-Day RCE Exploits


Here is the list of Zerodium's payouts for Tor Browser Exploits:

  • RCE and LPE to Root/SYSTEM for Tor Browser on Tails 3.x (64bit) and on Windows 10 RS3/RS2 (64bit) without JavaScript: $250,000
  • Only RCE (No LPE) for Tor Browser on Tails 3.x (64bit) and on Windows 10 RS3/RS2 (64bit) without JavaScript: $185,000
  • RCE+LPE to Root/SYSTEM for Tor Browser on Tails 3.x (64bit) and on Windows 10 RS3/RS2 (64bit) with JavaScript: $125,000
  • Only RCE (No LPE) for Tor Browser on Tails 3.x (64bit) and on Windows 10 RS3/RS2 (64bit) with JavaScript: $85,000
  • RCE and LPE to Root/SYSTEM for Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) without JavaScript: $200,000
  • Only RCE (No LPE) for Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) without JavaScript: $175,000
  • RCE and LPE to Root/SYSTEM for Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) with JavaScript: $100,000
  • Only RCE (No LPE) for Tor Browser on Tails 3.x (64bit) OR on Windows 10 RS3/RS2 (64bit) with JavaScript: $75,000


Those interested can submit their exploit until November 30th, 2017 at 6:00 pm EDT. The company also notes that the bounty may be terminated before its expiration if the total payout to researchers reaches one million U.S. dollars ($1,000,000).

Sunday, August 04, 2013 Mohit Kumar

TOR is the dark side of the Internet, the so-called dark web, which provides a safe haven to privacy advocates but is also where drugs, child pornography, assassins for hire and other weird and illegal activities can allegedly be traded.

A claimed zero-day vulnerability in Firefox 17 was used by the FBI to identify some users of the privacy-protecting Tor anonymity network. The FBI did not compromise the TOR network itself and The complex multi-layers of encryption still stand. Instead the FBI compromised the TOR browser only using a zero-day JavaScript exploit and used this to implant a cookie which fingerprinted users through a specific external server.
Eric Eoin Marques, 28 year-old man in Ireland believed to be behind Freedom Hosting, the biggest service provider for sites on the encrypted Tor network, is awaiting extradition on child pornography charges. It is understood the FBI had spent a year trying to locate Mr Marques.

Marques was arrested on a Maryland warrant that includes charges of distributing and promoting child porn online. He faced four charges relating to alleged child pornography offenses with a total of 30 years jail, reportedly dubbed by the FBI as “the largest facilitator of child porn on the planet.” That need has been particularly heightened with the many revelations of the US Prism program and other cyber spying initiatives.

Mr Marques told the court he was born in the US but has lived in Ireland since he was five. He said he was last in Romania a few weeks ago when he withdrew €6,000 from his credit card to help a friend start a business. 

The Tor Network is a robust tool for journalists, whistleblowers, dissidents and others looking to publish information in a way that is not easily traced back to them. His arrest coincides with mass outages across the Darknet affecting popular services like Tor Mail, HackBB and the Hidden Wiki which were run on Freedom Hosting. Worse, there are reports of many well known TOR hidden services may be compromised using a browser exploit.

“The current news indicates that someone has exploited the software behind Freedom Hosting. From what is known so far, the breach was used to configure the server in a way that it injects some sort of javascript exploit in the web pages delivered to users. This exploit is used to load a malware payload to infect users’ computers. The malware payload could be trying to exploit potential bugs in Firefox 17 ESR, on which our Tor Browser is based. We’re investigating these bugs and will fix them if we can.” Andrew Lewman, Tor Project's Executive Director said in a blog post.

Mozilla says it has been notified of a potential security vulnerability in Firefox 17 (MFSA 2013-53) , which is currently the extended support release (ESR) version of Firefox. The Exploit code posted by Mozilla and Deobfuscated JS used by the Tor Browser exploit posted on Google Code.

The malicious Javascript is a tiny Windows executable hidden in a variable named “Magneto”, but the Magneto code doesn’t download anything. It looks up the victim’s MAC address and the victim’s Windows hostname. Then it sends it to the Virginia server, outside of Tor, to expose the user’s real IP address, and coded as a standard HTTP web request.

The FBI appears to have gained access to Freedom Hosting and injected malicious HTML code that checks the visitor’s browser to see if he is using Firefox 17. Some visitors looking at the source code of the maintenance page realized that it included a hidden iframe tag that loaded a mysterious clump of Javascript code from a Verizon Business internet address located in eastern Virginia.

The Openwatch reported that, The execution of malicious JavaScript inside the Tor Browser Bundle, perhaps the most commonly used Tor client, comes as a surprise to many users. Previously, the browser disabled JavaScript execution by default for security purposes, however this change was recently reverted by developers in order to make the product more useful for average internet users. As a result, however, the applications have become vastly more vulnerable to attacks such as this.

The JavaScript code's payload analyzed by reverse engineering and exploit developer Vlad Tsyrklevich, who reveals that it briefly connects to a server and sends the hostname and MAC address of the victim.  "Briefly, this payload connects to 65.222.202.54:80 and sends it an HTTP request that includes the host name (via gethostname()) and the MAC address of the local host (via calling SendARP on gethostbyname()->h_addr_list). After that it cleans up the state and appears to deliberately crash."

Microsoft used to provide the US government with a an early start on its security vulnerabilities, which was reportedly used to aid its cyber espionage programs. But here no idea at this point, that Mozilla worked with the government in this case.

Of course, this shows how complacency can be a very bad thing, especially when it comes to security. In its attempts to bring down child abuse images, but it could also mean a serious security breach for international activists and internet users living in repressive states who use the services to practice online free speech.

Be sure you're running a recent enough Tor Browser Bundle. That should keep you safe from this attack. Windows users are advised to Update Tor Browser Bundle, version 2.3.25-10 (released June 26 2013), 2.4.15-alpha-1 (released June 26 2013), 2.4.15-beta-1 (released July 8 2013), 3.0alpha2 (released June 30 2013) includes the fix. Consider disabling JavaScript (click the blue"S" beside the green onion, and select "Forbid Scripts Globally"). Disabling JavaScript will reduce your vulnerability to other attacks like this one, but disabling JavaScript will make some websites not work like you expect.

Update: According to Baneki Privacy Labs research, the IP address 65.222.202.53 hardcoded into the exploit belongs to Virginia is actually owned by Science Applications International Corporation (SAIC), a major intelligence, military, aerospace, engineering and systems contractor involved with the Federal Bureau of Investigation (FBI), Defense Advanced Research Projects Agency (DARPA) , Central Intelligence Agency (CIA) and National Security Agency (NSA).

They believe that the hardcoded IP address is directly allocated to the NSA's Autonomous Systems (AS), so its probably not the FBI, its NSA who used Firefox Zero-Day exploit to compromise Freedom Hosting and TOR network.

Thursday, February 16, 2017 Swati Khandelwal

A Simple JavaScript Exploit Bypasses ASLR Protection On 22 CPU Architectures
Security researchers have discovered a chip flaw that could nullify hacking protections for millions of devices regardless of their operating system or application running on them, and the worse — the flaw can not be entirely fixed with any mere software update.

The vulnerability resides in the way the memory management unit (MMU), a component of many CPUs, works and leads to bypass the Address Space Layout Randomization (ASLR) protection.

ASLR is a crucial security defense deployed by all modern operating systems from Windows and Linux to macOS, Android, and the BSDs.

In general, ASLR is a memory protection mechanism which randomizes the location where programs run in a device's memory. This, in turn, makes it difficult for attackers to execute malicious payloads in specific spots in memory when exploiting buffer overflows or similar bugs.

In short, for attackers, it's like an attempt to burglarize a house blindfolded.

But now a group of researchers, known as VUSec, from the Vrije University in the Netherlands have developed an attack that can bypass ASLR protection on at least 22 processor micro-architectures from popular vendors like Intel, AMD, ARM, Allwinner, Nvidia, and others.

The attack, dubbed ASLR Cache or AnC, is particularly serious because it uses simple JavaScript code to identify the base addresses in memory where system and application components are executed.

So, merely visiting a malicious site can trigger the attack, which allows attackers to conduct more attacks targeting the same area of the memory to steal sensitive information stored in the PC's memory.

Here's How the attack works:

The attack exploits the way microprocessors and memory interacts with each other.

MMU, which is present in desktop, mobile and server chips and tasks to map where a computer stores programs in its memory, constantly checks a directory called a page table to keep track of those addresses.

Devices usually store the page table in the CPU’s cache which makes the chip speedier and more efficient. But this component also shares some of its cache with untrusted applications, including browsers.

Therefore, a piece of javascript code running on a malicious website can also write to that cache (side channel attack), allowing attackers to discover where software components, like libraries and RAM-mapped files, are located in virtual memory.

With these location data in hands, any attacker can read portions of the computer's memory, which they could then use to launch more complex exploits, escalate access to the complete operating system, and hijack a computer system.

The researchers successfully exploited AnC JavaScript attacks via up-to-date Chrome and Firefox web browsers on 22 different CPU micro-architectures in about 90 seconds, even despite ASLR protections built within those browsers, like broken JavaScript timers.

The VUSec research team have published two research papers [1, 2] detailing the AnC attack, along with two video demonstration showing the attack running in a Firefox browser on a 64-bit Linux machine.
In their attack, the researchers combined their AnC JavaScript with attack code that exploits a now-patched use-after-free vulnerability (CVE-2013-0753) in Firefox. Issues with AnC attacks are tracked through several CVE identifiers, including:
  • CVE-2017-5925 for Intel processors
  • CVE-2017-5926 for AMD processors
  • CVE-2017-5927 for ARM processors
  • CVE-2017-5928 for a timing issue affecting multiple browsers
VUSec team already notified all the affected chipmakers and software firms, including Intel, AMD, Samsung, Nvidia, Microsoft, Apple, Google, and Mozilla, more than three months ago, but only now went public with their findings.
"The conclusion is that such caching behavior and strong address space randomization are mutually exclusive," the paper concludes. "Because of the importance of the caching hierarchy for the overall system performance, all fixes are likely to be too costly to be practical." 
"Moreover, even if mitigations are possible in hardware, such as separate cache for page tables, the problems may well resurface in software. We hence recommend ASLR to no longer be trusted as the first line of defense against memory error attacks and for future defenses not to rely on it as a pivotal building block."
According to the team, the only way you can protect yourself against AnC attacks is to enable plug-ins, such as NoScript for Firefox or ScriptSafe for Chrome, to block untrusted JavaScript code on web pages from running in the browser.

Monday, June 22, 2015 Swati Khandelwal

WebAssembly — New Standard for Powerful and Faster Web Apps
Google, Apple, Microsoft, and Mozilla have joined hands to create code for use in the future web browsers that promises up to 20 times faster performance.

Dubbed WebAssembly (or wasm for short), a project to create a new portable bytecode for the Web that will be more efficient for both desktop as well as mobile web browsers to parse than the complete source code of a Web page or an application.

Bytecode is actually a machine-readable instruction set that is faster for web browsers to load than high-level languages.

WebAssembly — A New File Format to Compile Code


At the moment, browsers use JavaScript to interpret the code and allow functionality on websites such as dynamic content and forms. By default, JavaScript files are downloaded from the server and then compiled by the JavaScript engine in the web browser.

However, improvements have been made to load times via Asm.js — the stripped-down JavaScript dialect described as an "assembly language for the web" — but bytecode-based systems such as .NET are faster and enable efficient compilation.

WebAssembly will introduce a new file format that will allow developers to compile their code to a binary notation, which will then be executed inside each browser's (e.g. Chrome, Firefox, IE/Edge, Safari) JavaScript engine.

If introduced as a standard implemented in all web browsers, WebAssembly could surely bring app-like performance to Web content as well as applications.

Over 20% Faster Performance


Preliminary tests already show that the binary representation is 23 times faster to parse than similar JavaScript applications optimized through Mozilla's widely supported asm.js for browsers, and 20 to 30 percent smaller than its actual file size.
"I'm happy to report that we at Mozilla have started working with Chromium, Edge and WebKit engineers on creating a new standard, WebAssembly," said Mozilla developer Luke Wagner, "that defines a portable, size- and load-time-efficient format and execution model specifically designed to serve as a compilation target for the Web."
Currently, only C and C++ code can be compiled into a WebAssembly (a.k.a wasm) file.

Moreover, the developers of wasm know that JavaScript is supported everywhere so for older web browsers, they are providing a polyfill — a JavaScript script that will convert WebAssembly bytecode into asm.js for those browsers that don't support wasm.

WebAssembly is still in its early days of development with no formal standards as of now. The specifications and the high-level design has also not decided yet, but with all four major browser developers working together, wasm should appear soon.

The future possibilities for WebAssembly file format are being explored on GitHub page. However, a new WebAssembly Community Group has already been formed by the World Wide Web Consortium (W3C), which is open for anyone to join. These are FAQs that will give you more details on the group plans.

Friday, December 29, 2017 Mohit Kumar

same-origin-policy-bypass
A critical vulnerability has been discovered in the browser app comes pre-installed on hundreds of millions of Samsung Android devices that could allow an attacker to steal data from browser tabs if the user visits an attacker-controlled site.

Identified as CVE-2017-17692, the vulnerability is Same Origin Policy (SOP) bypass issue that resides in the popular Samsung Internet Browser version 5.4.02.3 and earlier.

The Same Origin Policy or SOP is a security feature applied in modern browsers that is designed to make it possible for web pages from the same website to interact while preventing unrelated sites from interfering with each other.

In other words, the SOP makes sure that the JavaScript code from one origin should not be able to access the properties of a website on another origin.
The SOP bypass vulnerability in the Samsung Internet Browser, discovered by Dhiraj Mishra, could allow a malicious website to steal data, such as passwords or cookies, from the sites opened by the victim in different tabs.
"When the Samsung Internet browser opens a new tab in a given domain (say, google.com) through a Javascript action, that Javascript can come in after the fact and rewrite the contents of that page with whatever it wants," researchers from security firm Rapid7 explained.
"This is a no-no in browser design since it means that Javascript can violate the Same-Origin Policy, and can direct Javascript actions from one site (controlled by the attacker) to act in the context of another site (the one the attacker is interested in). Essentially, the attacker can insert custom Javascript into any domain, provided the victim user visits the attacker-controlled web page first."
Attackers can even snag a copy of your session cookie or hijack your session and read and write webmail on your behalf.

Mishra reported the vulnerability to Samsung, and the company replied that "the patch is already preloaded in our upcoming model Galaxy Note 8, and the application will be updated via Apps store update in October."

Meanwhile, Mishra, with the help of Tod Beardsley and Jeffrey Martin from Rapid7 team, also released an exploit for Metasploit Framework.

Rapid7 researchers have also published a video demonstrating the attack.

Since the Metasploit exploit code for the SOP bypass vulnerability in the Samsung Internet Browser is now publicly available, anyone with less technical knowledge can use and exploit the flaw on a large number of Samsung devices, most of which are still using the old Android Stock browser.

Monday, January 04, 2016 Swati Khandelwal

javascript-ransomware-malware
Here's New Year's first Ransomware: Ransom32.

A new Ransomware-as-a-service, dubbed Ransom32, has been spotted that for the first time uses a ransomware written in JavaScript to infect Mac, Windows as well as Linux machines.

Ransom32 allows its operators to deploy the malware very quickly and easily. It has a dashboard that enables operators to designate their Bitcoin addresses to which the ransom can be sent. The dashboard also shows stats about how much Bitcoins they have made.

In short, this new ransomware-as-a-service is so simple, and efficient at the same time, that anyone can download and distribute his/her own copy of the ransomware executable as long as he/she have a Bitcoin address.

The copy of Ransom32 was first analysed by Emsisoft, which found that the new ransomware family, which embedded in a self-extracting WinRAR archive, is using the NW.js platform for infiltrating the victims' computers, and then holding their files by encrypting them with 128-bit AES encryption.


But, Why the NW.js Framework?

ransom32-malware
NW.js, formerly known as Node-WebKit, is a JavaScript framework for app development based on Node.js and Chromium. It works around normally-strict sandboxing of JavaScript, so a Web app can be repurposed for desktops without the sandbox getting in its way.
"NW.js allows for much more control and interaction with the underlying operating system (OS), enabling JavaScript to do almost everything 'normal' programming languages like C++ or Delphi can do," Emsisoft's Fabian Wosar writes.
The NW.js framework not only allows for cross-platform infections but also is harder to detect because it is a legitimate framework. Ransom32 has some resemblance to CryptoLocker that is one of the nasty ransomware that already infected millions of PCs.

Ransom32 has been traded on the dark web with the authors asking for a 25 percent cut of all ransom payments for offering its service and forwarding the rest of the amount to the operator’s Bitcoin address.


How Does Ransom32 Work?


Malware operators place the malicious file inside emails masquerading as delivery notifications, unpaid invoices, and such.

As soon as it was installed and launched, Ransom32 connected to a command-and-control (C&C) server on TOR anonymising network, displaying ransom note as shown above and the Bitcoin address where victims are supposed to pay to recover their files.

Currently, Wosar has only seen Ransom32 as a Windows attack vector, but the NW.js framework can run on all three major operating systems.

Therefore, ransomware coded to work on top of NW.js would theoretically be able to target Mac OS X as well as Linux operating systems.

How to Protect Yourself from Ransomware Threat?


Here are some important steps that should be considered to protect yourself from Ransomware threats.
  • Always keep regular backups of your important data.
  • Make sure you run an active anti-virus security suite of tools on your system.
  • Do not open email attachments from unknown sources.
  • Most importantly, always browse the Internet safely.

To keep yourself safe, we also have an excellent article on How to protect your computer from ransomware malware?

Sunday, December 06, 2015 Swati Khandelwal

Chakra: The Open-Source JavaScript Engine of Microsoft Edge browser
Microsoft has announced the plans to open source the core components of its "Chakra" – the JavaScript engine behind the new Edge browser – to GitHub code-sharing and collaboration repository next month.

The company made this announcement at the JSConf US Last Call conference in Florida this weekend.

What is Chakra?


"Chakra," developed in 2008, is a self-contained JavaScript virtual machine that Microsoft now lets developers implement in their own products and applications.

Though Chakra is at the core of only Microsoft's Edge, it is used across the Microsoft's newest operating system Windows 10 to power Universal Apps on Xbox, Windows Phone and tablets.

Chakra Going Open Source as ChakraCore


ChakraCore – is what Microsoft is calling the open source version of its Chakra – will be made available on GitHub under an MIT open source license in January 2016, with support from Intel, AMD, and NodeSource.
According to the Microsoft's official blog, "We're investing more than ever in improving Chakra and are excited to team up with our community to drive further improvements. In addition to the public [Microsoft means the 'open source community'], several organizations have already expressed interest in contributing to ChakraCore — among many others, we look forward to working with Intel, AMD and NodeSource as we develop this community."

ChakraCore Doesn't Include:


There are some differences between ChakraCore and Chakra as ships in Windows 10. The complete Chakra contains the adhesive between both:
  • The JavaScript engine and the browser's HTML engine
  • The JavaScript engine and the Universal Windows Platform
Chakra also has diagnostic APIs (Application Program Interfaces) that use COM and hence are Windows-specific.

However, neither of the above are part of the open source ChakraCore project. It only contains the 'core packages' for the engine, so doesn't expose Chakra's private bindings to the Edge browser or Universal Applications or make available COM diagnostic APIs.

What Does Chakra Offer?


The fully supported and open source ChakraCore project includes everything:
  • The parser
  • The interpreter
  • The JIT (just-in-time) compiler
  • The Garbage collector
  • The application programming interface (API) used to embed the engine into apps (like used in Edge)
It's an interesting and impressive move from the company like Microsoft that has rarely open sourced its projects. With this move, the company believes ChakraCore will be used in a large number of apps in the future, from cloud services to the Internet of Things (IoT).

Isn't that an exciting New Year gift for developers?

Friday, May 01, 2015 Mohit Kumar

bypass-Google-Password-Alert
Less than 24 hours after Google launched the new Phishing alert extension Password Alert, a security researcher was able to bypass the feature using deadly simple exploits.

On Wednesday, the search engine giant launched a new Password Alert Chrome extension to alert its users whenever they accidentally enter their Google password on a carefully crafted phishing website that aimed at hijacking users’ account.

However, security expert Paul Moore easily circumvented the technology using just seven lines of simple JavaScript code that kills phishing alerts as soon as they started to appear, defeating Google’s new Password Alert extension.

Google shortly fixed the issue and released a new update to Password Alert extension that blocked the Moore’s exploit. However, Moore discovered another way to block the new version of Password Alert, as well.

The first proof of concept exploit by Moore relied on a JavaScript that looks for instances of warning screen every five milliseconds and simply removes anything it detects. Generally, the warning screen is still there, but the exploit prevented the user from ever seeing it.

Moore (@Paul_Reviews) posted the proof-of-concept JavaScript exploit yesterday, explaining that Google’s Password Alert can be bypassed by anyone using just seven lines of code.

Here’s the Kicker:


However, Google assured its users that the company has now fixed the issue, releasing Password Alert version 1.4. "To update quickly, go to Chrome://extensions/ , enable developer mode, click update extensions now," Google engineer Drew Hintz said.

But Moore didn’t want to stop here. He began analyzing the code for the extension more closely and figured out another way to bypass Password Alert, effectively killing phishing alerts as soon as they generated.

No simple this time baby:


And according to Moore, the second exploit developed by him will be more difficult for Google to repair.

Moore also provided a proof-of-concept video on YouTube showing the attack in action. You can watch the video below:

Now, let’s see how much time the search engine giant would take to fix this issue in its all new Password Alert Chrome Extension.

The technology was just launched by Google on Wednesday, so you can expect some flaws at its early stage. Password Alert extension has been installed by nearly 30,000 Chrome users, who are advised to update version 1.4, the latest version available at the moment, to fix the first issue.

In order to fix another problem, you may have to wait until Google releases the next update. Till then, you are advised to turn on two-factor authentication and use a good password manager to protect yourself against phishing attacks.

Update: GOOGLE ALERT 1.6 ALSO BYPASSED


After Google released the updated version 1.6 of Password Alert that fixed the second exploit rolled out by Paul Moore, security researchers from Securify firm discovered a way to again bypass Google’s Password Alert feature in the latest version.

The Researchers created a new exploit that works against both Password Alert version 1.5 and version 1.6, which executes in following two steps:

1. Disable Javascript: In HTML, iFrame has a sandbox attribute using which an attacker can disable Javascript for particular iframe only. Following example will completely disable Password Alert. The PoC is fairly simple:
<iframe src="phishing_page.htm" sandbox="allow-forms"></iframe>
2. Fooling with First 100,000 Blank Bytes: Google Password Alert checks whether a web page looks like a Google Login by looking at the first 100,000 bytes of the HTML. So, this could be bypassed simply by using the following JavaScript:
passwordalert.looksLikeGooglePageTight_ = function() { var allHtml = document.documentElement.innerHTML.slice(0, 100000); }
And Boom!

Friday, October 29, 2010 Mohit Kumar

http://www.xtremecoders.org/wp-content/uploads/2010/07/router-hack.jpg
After having attended the past couple of DEFCONs, I'm really excited to be speaking at DEFCON 18 this year. In anticipation of my presentation, "How to Hack Millions of Routers", I thought I'd take this opportunity to answer some questions, offer some background information, and give a quick teaser about the talk.

Most people assume that because they don't have remote administration enabled on their router, external attackers cannot access their router's administrative Web interface. However, for many routers this is simply not true; anyone with a registered domain can in fact gain full interactive access to the router's internal Web interface in order to exploit vulnerabilities or log in to the device (either via the router's default password or a brute-force attack), at which point they can view settings, change settings and generally do whatever else they want with the router*. However, this attack is not restricted to the primary Web interface; it can also be used to gain interactive access to SOAP-based services running on the router as well, such as Universal Plug-n-Play which requires no authentication at all. While this attack does not work against all routers, out of thirty different routers tested the attack was successful against more than half of them, including the venerable WRT54G from Linksys, ActionTec routers used by Verizon FiOS and DSL customers, and many others. Given the number and popularity of the affected routers, this translates into many millions of vulnerable routers deployed world wide, not to mention all the other routers that have not yet been tested.

The attack is actually a combination of many things, from browsers and JavaScript to firewalls and TCP/IP stacks, but it ultimately centers around DNS rebinding*. Although DNS rebinding has been publicly discussed for almost 15 years, many people still don't completely understand it. I've gotten several inquiries about the talk, and they generally boil down to two basic questions:

1) What is DNS rebinding?
2) What is so special about the DNS rebinding technique presented in this talk?

To understand DNS rebinding, let's examine why DNS rebinding is needed in the first place: the same domain policy. The same domain policy is a security policy that is enforced by your Web browser. That policy states that if you browse to http://www.evilhacker.com/, then that page from www.evilhacker.com can tell your Web browser to load content from other Web sites (images, JavaScript, CSS, iframes, etc), but it cannot see the responses from those Web sites nor access the content that is returned by those Web sites. In other words, JavaScript from www.evilhacker.com can only access content from www.evilhacker.com because that content comes from the same domain. This is a good thing, as you wouldn't want some JavaScript from www.evilhacker.com making unauthorized XmlHttpRequests to Web sites inside your local network or elsewhere.

The problem with this policy is that computers don't use domain names to communicate with each other; they use IP addresses. The idea behind DNS rebinding is:

1) Get the victim to load some JavaScript from www.evilhacker.com.
2) Convince the victim's browser that www.evilhacker.com has moved to a different IP address, say, 192.168.1.1.
3) Evil hacker's JavaScript is free to interact with www.evilhacker.com, which the browser now thinks is located at 192.168.1.1.

The difficult part in the above attack is convincing the victim's browser to switch IP addresses. Various methods of achieving this have been presented in the past, so why yet another talk on DNS rebinding attacks? Because quite simply, the common DNS rebinding attacks that have been discussed in the past are either not practical or simply no longer work:

o Setting low TTL values in DNS responses doesn't work anymore because of DNS pinning.
o Anti-DNS pinning attacks only work in older browsers (IE6/7, FF2.x), and even then the rebinding attack takes between 15 and 120 seconds to take effect depending on the victim's browser.
o The "multiple A record" technique can no longer be used to rebind to internal (RFC1918) IP addresses.
o In addition to browsers, third party plug-ins such as Flash and Java have implemented anti-rebinding measures.
Thanks to several features present in many popular routers and their underlying operating systems*, none of this will deter the attack discussed in this talk, which has been tested against live networks under real-world scenarios (with the appropriate permissions from the network owners, naturally). Common anti-DNS rebinding protections offered by services such as dnsmasq, OpenDNS and NoScript will not prevent this attack, nor will changing the router's internal IP address. The good news is that there are fixes that can be made by both vendors and end users to protect against this attack*. The bad news is that these are fixes that should have been implemented years ago, but instead have been ignored by both vendors and users alike.

Of course, what is a talk without a tool release? I will be demoing and releasing a tool that automates the entire attack and extends the target router's internal Web interface out to an external Web site where the attacker can access and browse the router's Web pages in real time, just as if he were sitting on the LAN himself. All the attacker needs is a user inside the target network to browse to the attacker's Web site. It's point-and-click hacking goodness that's fun for the whole family!

* To be discussed in more detail at the talk!
Source : Def Con

Friday, May 12, 2017 Exclusive Deals

learn-computer-programming-how-to-code-online-training-course
Struggling to learn how to code?

If you’re looking to 'learn how to code' and seeking a career as an expert-level programmer, you should know how to play with codes and make your own.

It's no secret that mastering a coding language or two can put you at the top of the job market – thanks to the boom in technology.

Today, you can elevate your programming skills straight from the Internet to become an actual coder, but getting into a heavy subject like coding involves a lot of time and money.

‘Learn to Code’ 2017 Bundle: Get 10 Courses in 1 Pack


Fortunately for you, this week's THN Deal Store brings the Ultimate Learn to Code 2017 Bundle that gives you access to 10 online training courses in 1 single account at just $49, instead of $1,186. This 95% discount is valid for next few days.

The Ultimate Learn to Code 2017 Bundle, comes with lifetime access, offers you professional training courses on Python, Ruby, Java, iOS, HTML, CSS, AngularJS and other programming languages that are in high demands, that users can browse through desktop or mobile.

How to Join this Training Course?


All these impressive courses come in a single package, Ultimate Learn to Code 2017 Bundle, which is available at just $39 (95% discount valid for next few days) at the THN Deals Store.

So, what you are waiting for? Sign up your account here, click ‘Add to Cart’ and grab the exclusive discounted deal NOW!

95% OFF — Register for this Training

Let's dig deeper. Here below we have elaborated each course for our interested readers.

Complete HTML5 & CSS3 Course: Build Professional Sites


HTML and CSS are two essential programming languages for building and designing websites. With these two languages, you will have the skills to create professional as well as responsive websites that clients and users will love.

Even if your goal is not to become a web-designer, learning HTML and CSS is an essential step to getting into Information Technology domain.

In this course, you’ll have access to 57 video lectures that will help you learn the basics of HTML and CSS, how to approach page layout, and create responsive websites with practical examples.

Learn Python: Best Programming Language of 2017


Python is a powerful general-purpose, an easy to learn, versatile programming language, which is not just limited to web development, you can use it to analyze data, build games, and more.

Python has rapidly become popular among Hackers, Reverse engineers, software testers, Forensic analyst and Penetration testers, as most Python programs run on all the key operating systems including Windows, Linux, Mac, and more.

In short, if you are a beginner, Python is perfect language to start with.

With this course, you'll have access to 76 video lectures that will take you through the basics of Python, help you scale up your knowledge and prepare you to build a wide variety of applications using Python.

Learn Java Programming: Course for Beginners


So, you want to program in Java? That's good; this course includes 69 video lectures that are fast, easy, and efficient.

Developed by Sun Microsystems in 1995, Java is among the most popular high-level programming languages out there and is one of the highest paying programming languages on earth.

Java runs on a variety of platforms, such as Windows, Mac OS, and Linux and can be used to develop different types of cross-platform applications, including desktop software, mobile applications, and large systems development.

Regardless of your coding experience, you can become an expert with the help of this course, which will take you all the way through basics to advanced concepts, covering all the core concepts you need to know to become a productive Java developer.

Learn ‘Ruby On Rails’ from Scratch


Ruby on Rails is an open source, easy-to-use and extremely productive web development framework written in Ruby.

Some of the top sites are using Ruby on Rails to build backend of their websites and apps, such as Twitter, Shopify, Airbnb, Github, LivingSocial, Hulu, Groupon and Yellow Pages.

If you want to create highly functional and robust web apps in the shortest possible time with the least possible pain, Ruby on Rails is an excellent choice.

This course is giving you an in-depth tutorial on Ruby on Rails with 167 video lectures, designed for students of all levels and backgrounds.

You can learn some of the newest features, including building real-time apps, and master advanced development techniques.


Learn Angular 2 and TypeScript


Angular 2 is the next big thing. It is one of the leading frameworks for building modern, scalable, cross-platform applications. If you are seeking a career as a front-end or a full-stack developer, you need to learn Angular 2.

Approved by Google Developer Expert Todd Motto, this Angular 2 with TypeScript for Beginners Guide will help you build real-world apps with Angular and master the core Angular 2.

Become a JavaScript Expert


JavaScript is one of the powerful and popular languages for programming on the web. If you are interested in pursuing your career in web development, then you should become proficient in JavaScript.

Almost every digital development project involves some level of JavaScript, which is why experts are always in demand. Whether you are a business owner, a freelancer, or seeking to work in the web development industry, this course will get you started on the right path.

This course includes 96 lectures that will take you from a complete JavaScript beginner to an advanced developer, and at the end of this course, you'll be eligible for the JavaScript Specialist Designation exam to give a boost to your career.


iOS 10 Developer Boot Camp: Learn Objective-C


Do you want to create iPhone iOS 10 apps but have little or no programming experience? Then this is the perfect course for you!

An average iOS developer makes about $90,000 per year, and you too can be part of them. All you need is this ultimate iOS 10 & Objective-C: Complete Developer Course that will give you everything you need to start your new career in iOS 10 development.

This online course will teach you how to create iOS 10 apps in Xcode 8 and Objective-C, from concept to submission to the App Store.

To help you understand the process of building applications within Objective-C, this course will let you create over 20 real iOS 10 apps, ranging from fun and simple games to powerful utility apps using the native features of iPhones and iPads.

SQL Server Training Course


SQL Server is one of most popular database programming language in the world today, also known as Microsoft’s enterprise database management system.

Learning SQL is one of the best and fastest ways to improve your career prospects, as SQL is one of the most in-demand tech skills by many Fortune 500 companies and startups of all sizes across the globe.

SQL Server training is available online with a total of 35 video lectures that will help you learn the fundamentals of ASP.NET, IIS, and Visual Studio, writing SQL to perform a variety of data manipulations, as well as implement and manage database solutions.

Xamarin for Absolute Beginners: Create Cross-Platform Apps


Xamarin is pretty amazing mobile app development framework that allows developers to create cross-platform native applications for Android, iOS and Windows Phone.

To make the same app for both Android and iOS, you don't need to learn both Java and Swift. Xamarin lets you use the C# programming language to build fully-functional apps for both iOS and Android at the same time.

This online video training course includes 48 lectures that will help you to learn mobile applications development from zero to deployment with in-depth guides.


How to Join this Training Course?


All these impressive courses come in a single package, Ultimate Learn to Code 2017 Bundle, which is available at just $39 (95% discount valid for next few days) at the THN Deals Store.

95% OFF — Register for this Training

So, what you are waiting for? Sign up your account here, click ‘Add to Cart’ and grab the exclusive discounted deal NOW!

Other Popular Hacking Course Packages


We received a great response from our last three deals as well and if you want, you can still grab these deals:
  • Computer Hacker Professional Certification Package — at 96% discount — offers you all the material and training you require to help pass CISSP, CISM, CISA, Ethical Hacker and Forensics Investigator Certification Exams to become certified penetration tester.
  • Wi-Fi Hacking and Penetration Testing Training Course — at 83% discount — This training course, which costs just $25, is available with lifetime access and focuses on the practical side of Wi-Fi hacking without neglecting the theory behind each attack. All the attacks explained in this course are practical attacks launched against real Wi-Fi networks.
  • VPNSecure: Lifetime Subscription (91% OFF) — If you're searching for an affordable and reliable VPN service without any bandwidth limits, VPNSecure is a good option. With strict no-log record policy, VPNSecure has many servers located in more than 41 countries and counting. The VPNSecure Lifetime Subscription is available for just $39 at THN Deals Store.

Thursday, August 17, 2017 Wang Wei

foxit-pdf-reader
Are you using Foxit PDF Reader? If yes, then you need to watch your back.

Security researchers have discovered two critical zero-day security vulnerabilities in Foxit Reader software that could allow attackers to execute arbitrary code on a targeted computer, if not configured to open files in the Safe Reading Mode.

The first vulnerability (CVE-2017-10951) is a command injection bug discovered by researcher Ariele Caltabiano working with Trend Micro's Zero Day Initiative (ZDI), while the second bug (CVE-2017-10952) is a file write issue found by Offensive Security researcher Steven Seeley.

An attacker can exploit these bugs by sending a specially crafted PDF file to a Foxit user and enticing them to open it.

Foxit refused to patch both the vulnerabilities because they would not work with the "safe reading mode" feature that fortunately comes enabled by default in Foxit Reader.
"Foxit Reader & PhantomPDF has a Safe Reading Mode which is enabled by default to control the running of JavaScript, which can effectively guard against potential vulnerabilities from unauthorized JavaScript actions," the company says.
However, researchers believe building a mitigation doesn't patch the vulnerabilities completely, which if remained unpatched, could be exploited if attackers find a way to bypass safe reading mode in the near future.

Both unpatched vulnerabilities can be triggered through the JavaScript API in Foxit Reader.

CVE-2017-10951: The command injection bug resides in an app.launchURL function that executes strings provided by attackers on the targeted system due to lack of proper validation, as demonstrated in the video given below.

CVE-2017-10952: This vulnerability exists within the "saveAs" JavaScript function that allows attackers to write an arbitrary file on a targeted system at any specific location, as demonstrated in the video given below.
"Steven exploited this vulnerability by embedding an HTA file in the document, then calling saveAS to write it to the startup folder, thus executing arbitrary VBScript code on startup," reads the advisory published by the ZDI.
If you are one of those using Foxit Reader and PhantomPDF, ensure you have the "Safe Reading Mode" feature enabled. Additionally, you can also uncheck the "Enable JavaScript Actions" from Foxit's Preferences menu, although this may break some functionality.

Users are also recommended always to be vigilant while opening any files they received via email. Just recently, we reported how opening a malicious PowerPoint file could compromise your computer with malware.

So, always beware of phishing emails, spams, and clicking the malicious attachment.

Update: Foxit Response

Foxit spokesperson has provided the following statement to The Hacker News via an Email:

"Foxit Software is deeply committed to delivering secure PDF products to its customers. Our track record is strong in responding quickly in fixing vulnerabilities. We are currently working to rapidly address the two vulnerabilities reported on the Zero Day Initiative blog and will quickly deliver software improvements. In the meantime, users can help protect themselves by using the Safe Reading Mode."
"We apologize for our initial miscommunication when contacted about these vulnerabilities and are making changes to our procedures to mitigate the probability of it occurring again."

Sunday, January 31, 2016 Swati Khandelwal

Do you know?… Any iOS app downloaded from Apple’s official App Store has an ability to update itself from any 3rd-party server automatically without your knowledge.

Yes, it is possible, and you could end up downloading malware on your iPhone or iPad.

Unlike Google, Apple has made remarkable efforts to create and maintain a healthy and clean ecosystem of its official App Store.

Although Apple's review process and standards for security and integrity are intended to protect iOS users, developers found the process time consuming and extremely frustrating while issuing a patch for a severe bug or security flaw impacting existing app users.

To overcome this problem, Apple designed a set of solutions to make it easier for iOS app developers to push straightway out hotfixes and updates to app users without going through Apple's review process.

Sounds great, but here's the Kick:

Malicious app developers can abuse These solutions, potentially allowing them to circumvent effectively the protection given by the official App Store review process and perform arbitrary actions on the compromised device, FireEye has warned.

The framework in question is JSPatch – a small JavaScript-to-ObjectiveC engine that developers can integrate in their iOS apps, allowing them to apply hotfixes on their iOS apps simply by adding a few lines of code to their apps.

How Does JSPatch Work?


Once the JSPatch engine loads inside an application, the developer can configure the app always to load a JavaScript file hosted on a remote server, which is controlled by the developer.

Developed by a Chinese developer, JSPatch is utilised in as many as 1,220 iOS apps in the App Store, according to researchers. Although they failed to name the apps, the researchers claim that they have already notified the app providers.

So, in need of security fixes or updates to their app, instead of going through Apple's long-winded update routine, developers can just add some JavaScript code to the file hosted on their server in order to load the code in all the devices where the app is installed.

How to Exploit the JSPatch Framework?


There are two ways to abuse this framework:
  • If the Developer is with malicious intention.
  • If developer loads this framework via an unencrypted channel, allowing Man-in-the-Middle attacks.



 What if the app developer has bad intention?

A malicious developer can first submit a harmless JSPatch integrated application to the Apple App Store.

Once it passed Apple's inspection and made available on the App Store for users to download, the developer can then easily send malicious JavaScript code to the running application through JSPatch, allowing the developer to perform various actions without being detected.

"JSPatch is a boon to iOS developers," FireEye researchers said in a blog post. "In the right hands, it can be used to quickly and effectively deploy patches and code updates. However, in a non-utopian world like ours, we need to assume that bad actors will leverage this technology for unintended purposes."

What if the app's developer loads JSPatch via an unencrypted channel?

If an application developer uses JSPatch without any malicious intentions, even then the users security is at risk. The developers who load JSPatch via an unencrypted (HTTP) channel could leave communications between the client and the server unprotected.



This could allow an attacker to conduct a man-in-the-middle (MitM) attack to intercept the client and server connection and tamper with the JavaScript content sent to the app in order to perform a malicious action, including:
  • Access to sensitive information, such as media files and the pasteboard content.
  • Change system properties.
  • Load arbitrary public frameworks into the app process.

This isn't the very first-time iOS users are facing such problems. Last October, hundreds of iOS apps in the App Store were found collecting user's private data while violating security and privacy guidelines of Apple.

The discovery came just a month after the XcodeGhost malware was distributed through legitimate iOS Apps via counterfeit versions of Apple's app developer toolkit called Xcode. Here's how to protect yourself against XCodeGhost like iOS flaws.

How to Protect Yourself?


The recommendations to protect yourself against this flaw are standard:
Download apps only from the official App Store, that you need, that you know, and that you trust.
Beware of applications that ask for an extensive amount of permissions and only grant the apps permissions that are necessary.

Manually review "everything" to discover anything malicious in your devices. Rest is up to the company if it wants to improve its application update process to make it speedier, or to allow potential attack vectors that could affect most of its apps and their users.

Monday, February 05, 2018 Mohit Kumar

wordpress-dos-attack-hacking
A simple yet serious application-level denial of service (DoS) vulnerability has been discovered in WordPress CMS platform that could allow anyone to take down most WordPress websites even with a single machine—without hitting with a massive amount of bandwidth, as required in network-level DDoS attacks to achieve the same.

Since the company has denied patching the issue, the vulnerability (CVE-2018-6389) remains unpatched and affects almost all versions of WordPress released in last nine years, including the latest stable release of WordPress (Version 4.9.2).

Discovered by Israeli security researcher Barak Tawily, the vulnerability resides in the way "load-scripts.php," a built-in script in WordPress CMS, processes user-defined requests.

For those unaware, load-scripts.php file has only been designed for admin users to help a website improve performance and load page faster by combining (on the server end) multiple JavaScript files into a single request.

However, to make "load-scripts.php" work on the admin login page (wp-login.php) before login, WordPress authors did not keep any authentication in place, eventually making the feature accessible to anyone.
wordpress dos attack

Depending upon the plugins and modules you have installed, the load-scripts.php file selectively calls required JavaScript files by passing their names into the "load" parameter, separated by a comma, like in the following URL:
https://your-wordpress-site.com/wp-admin/load-scripts.php?c=1&load=editor,common,user-profile,media-widgets,media-gallery
While loading the website, the 'load-scripts.php' (mentioned in the head of the page) tries to find each JavaScript file name given in the URL, append their content into a single file and then send back it to the user's web browser.

How WordPress DoS Attack Works

wordpress-dos-attack-tool
According to the researcher, one can simply force load-scripts.php to call all possible JavaScript files (i.e., 181 scripts) in one go by passing their names into the above URL, making the targeted website slightly slow by consuming high CPU and server memory.
"There is a well-defined list ($wp_scripts), that can be requested by users as part of the load[] parameter. If the requested value exists, the server will perform an I/O read action for a well-defined path associated with the supplied value from the user," Tawily says.
Although a single request would not be enough to take down the whole website for its visitors, Tawily used a proof-of-concept (PoC) python script, doser.py, which makes large numbers of concurrent requests to the same URL in an attempt to use up as much of the target servers CPU resources as possible and bring it down.

The Hacker News has verified the authenticity of the DoS exploit that successfully took down one of our demo WordPress websites running on a medium-sized VPS server.
"It is time to mention again that load-scripts.php does not require any authentication, an anonymous user can do so. After ~500 requests, the server didn't respond at all any more, or returned 502/503/504 status code errors," Tawily says.
However, attack from a single machine, with some 40 Mbps connection, was not enough to take down another demo website running on a dedicated server with high processing power and memory.
wordpress-hacking

But that doesn't mean the flaw is not effective against WordPress websites running over a heavy-server, as application-level attack generally requires a lot fewer packets and bandwidth to achieve the same goal—to take down a site.

So attackers with more bandwidth or a few bots can exploit this flaw to target big and popular WordPress websites as well.

No Patch Available  – Mitigation Guide

Along with the full disclosure, Tawily has also provided a video demonstration for the WordPress Denial of Service attack. You can watch the video to see the attack in action.

Knowing that DoS vulnerabilities are out-of-scope from the WordPress bug bounty program, Tawily responsibly reported this DoS vulnerability to the WordPress team through HackerOne platform.

However, the company refused to acknowledge the issue, saying that this kind of bug "should really get mitigated at the server end or network level rather than the application level," which is outside of WordPress's control.

The vulnerability seems to be serious because WordPress powers nearly 29 percent of the Web, placing millions of websites vulnerable to hackers and making them unavailable for their legitimate users.

For websites that can't afford services offering DDoS protection against application-layer attacks, the researcher has provided a forked version of WordPress, which includes mitigation against this vulnerability.

However, I personally wouldn't recommend users to install modified CMS, even if it is from a trusted source other than the original author.

Besides this, the researcher has also released a simple bash script that fixes the issue, in case you have already installed WordPress.

Newsletter Subscription

Subscribe to our newsletter and get all latest hacking news, free eBooks delivered to your inbox.

Join Over 450,000 Subscribers!