4 ms·
The timing attacks on AV software are interesting. Didn't know that was possible. Why doesn't the cross-domain policy reject pings to localhost immediately?
by pjs_ 10y ago
The timing attacks on AV software are interesting. Didn't know that was possible. Why doesn't the cross-domain policy reject pings to localhost immediately?
- TazeTSchnitzel 10y agoIndeed, why can you contact local network IPs from web pages at all? Browsers should, at the very least, prompt for permission first. Intranet and localhost services often have a lot of implicit trust in whoever can access them. They rarely have strong passwords, if any, for example.
- tobias3 10y agoPopuplar apps such as Dropbox and Spotify use it: https://bugs.chromium.org/p/chromium/issues/detail?id=378566 https://bugs.chromium.org/p/chromium/issues/detail?id=378566
- ruddct 10y agoThis jumped out at me too, very clever. I imagine that localhost isn't treated any differently to any other domain which might have CORS enabled. Unclear what the correct solution is, though. EDIT: Gaming this out a little bit, another interesting application of this technique could be to create a fairly accurate map of a Windows-centric private network. Example: Start with a bunch of known private network IP spaces, scan through as many IPs as possible, report back addresses that have open/closed/filtered ports.