4 ms·

"When a user clicks on a URL shortened by Stealth Falcon operators, the site profiles the software on a user’s computer, perhaps for future exploitation, before

"When a user clicks on a URL shortened by Stealth Falcon operators, the site profiles the software on a user’s computer, perhaps for future exploitation, before redirecting the user to a benign website containing bait content." But how?

ianpurton 10y ago
Browsers leave a certain amount of finger print. i.e. Flash version, Java and the browser versions and type is pretty easy to obtain. This may be enough information to produce a targeted attack. They also used timing attacks against various localhost ports using XMLHttpRequest. This is enough to detect Avast, Avira, ESET, Kaspersky, and Trend Micro antivirus products
- deleted 10y ago
  [deleted]
nl 10y ago
Section 3.4: For Internet Explorer, it attempts to create several instances of ActiveXObject to get the versions of Flash, Shockwave, Java, RealPlayer, Windows Media Player, and Microsoft Office (classified as either 2003, 2007, or 2010). For non-Internet Explorer browsers, it attempts to get a list of enabled plugins from navigator.mimeTypes. For all browsers, it captures the user agent, whether cookies are enabled, the OS, the size of the browser window, and the timezone. It classifies browsers into different versions, denoted by letters, based on the existence and behavior of certain JavaScript methods. The script attempts to exploit an information leak in older versions of Tor Browser. We explore the technique used in Section 3.5. For Windows browsers (except Opera, and versions of Internet Explorer before IE9), it sends a series of XMLHttpRequests to 127.0.0.1, which we believe are designed to deduce if the computer is running any one of several specific antivirus programs. The code for this appears to be borrowed from the JS-Recon port scanning tool.21 The creator of JS-Recon presented the tool at BlackHat Abu Dhabi in 2010.22 We explore such techniques in more detail in Section 3.6.
_9MOTHER9HORSE 10y ago
See: https://panopticlick.eff.org https://panopticlick.eff.org
us0r 10y ago
This was posted here a few (weeks)? ago: http://webkay.robinlinus.com/ http://webkay.robinlinus.com/

ianpurton 10y ago

Browsers leave a certain amount of finger print. i.e. Flash version, Java and the browser versions and type is pretty easy to obtain. This may be enough information to produce a targeted attack. They also used timing attacks against various localhost ports using XMLHttpRequest. This is enough to detect Avast, Avira, ESET, Kaspersky, and Trend Micro antivirus products

deleted 10y ago
[deleted]

nl 10y ago

Section 3.4: For Internet Explorer, it attempts to create several instances of ActiveXObject to get the versions of Flash, Shockwave, Java, RealPlayer, Windows Media Player, and Microsoft Office (classified as either 2003, 2007, or 2010). For non-Internet Explorer browsers, it attempts to get a list of enabled plugins from navigator.mimeTypes. For all browsers, it captures the user agent, whether cookies are enabled, the OS, the size of the browser window, and the timezone. It classifies browsers into different versions, denoted by letters, based on the existence and behavior of certain JavaScript methods. The script attempts to exploit an information leak in older versions of Tor Browser. We explore the technique used in Section 3.5. For Windows browsers (except Opera, and versions of Internet Explorer before IE9), it sends a series of XMLHttpRequests to 127.0.0.1, which we believe are designed to deduce if the computer is running any one of several specific antivirus programs. The code for this appears to be borrowed from the JS-Recon port scanning tool.21 The creator of JS-Recon presented the tool at BlackHat Abu Dhabi in 2010.22 We explore such techniques in more detail in Section 3.6.

_9MOTHER9HORSE 10y ago

See: https://panopticlick.eff.org https://panopticlick.eff.org

us0r 10y ago

This was posted here a few (weeks)? ago: http://webkay.robinlinus.com/ http://webkay.robinlinus.com/