4 ms·
> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local d
by gtirloni 3y ago
> The second is the fact that devices on the LAN are accessible to other devices on the LAN. Malicious JS in a webpage can scan for and compromise other local devices.
Which browser API enables that?
- Retr0id 3y agoHTTP, it's all the rage these days. (via <form>, fetch, XMLHttpRequest, et al)
- gtirloni 3y agoAh ok, so we are talking about dumb old methods. I thought it was something like the fancy APIs that are all the rage these days.
- Retr0id 3y agoThere was a brief window when people knew that if they used non-HTTP protocols, then malicious webpages couldn't talk to it. But now even "native" apps are web apps, and IoT devices all use web APIs too. They can be locked down through CORS etc., but it's easier for devs to set `Access-Control-Allow-Origin: *` and worry about it "later".
- kevincox 3y agoIn most cases `Access-Control-Allow-Origin: ` is actually a decent policy. It importantly blocks cross-site credentials. So as long as your API has any* authentication it should prevent it. The real mistake is mirroring the Origin header from the request in the `Access-Control-Allow-Origin` response header which allows credentials (unless you add other headers) Of course this all relies on you not accepting form posts without auth.
- metadat 3y agoI was skeptical at first, but did some superficial scouting.. it's trivial for a malicious website to do nasty things to any internal resource which doesn't have a strict CORS policy. https://security.stackexchange.com/questions/177486/can-websites-access-computers-in-lan-localhost-through-browser-how-to-block-th https://security.stackexchange.com/questions/177486/can-webs... As the adage goes, the "S" in IOT stands for "Security".
- Retr0id 3y agoYes, I have (non-public) variations of the https://rootmy.tv/ https://rootmy.tv/ exploit that can fully compromise an LG smart TV from the browser session of any other LAN-adjacent device.
- mewpmewp2 3y agoBut CORS is strict by default. They must specially add headers to allow such requests.
- blacksmith_tb 3y agoI suppose you could just loop through all the IPs for some common ranges like 10.0.0.0/16 and 192.168.0.0/16 looking for a given port, if you knew the toothbrushes exposed it and there was something exploitable there, that makes sense.
- metadat 3y agoEven 192.168.1.0/8 will probably get you ~95% coverage for residential networks.