HTML5 vs. Security

22. November, 2013

HTML5 vs. Security” was a talk given by Thomas Röthlisberger of Compass Security AG which gave a nice overview over some of the security problems that HTML5 brings.

Areas covered by the talk:

Together, those technologies allow remote attackers to scan internal networks, access intranet sites and track users.

For example, if you’re visiting a site while connected to a compromised WLAN access point, an attacker might send you a manifest for this site. The manifest then contains the names of some files which exist on the original site plus additional resources. When you’re back in a safe network, the browser will use the saved files when you visit the site again, making the attack permanent.

Another place to save malicious code is the local storage. Or we can use the local storage to attach a permanent ID to the browser / user.

CORS and WebSockets allow to scan the local network for open ports. With Web Workers, thousands of ports can be scanned in the background. Or you can use the technology to build an ad-hoc botnet to crack passwords.

Shell of the Future is a proof of concept that demonstrates how you use the browser of another person to browse the web. This means that the attacker can a) see all the information (session cookies, JavaScript) that the hijacked browser has and b) that the attacker can drive said browser (downloading more resources, scanning the intranet, etc).

In some cases, these vulnerabilities are necessary to make the new feature useful. What you need to be aware:

  • Decline strange/unexpected requests by your browser
  • When you configure your server, make sure you send the correct Access-Control-Allow-Origin headers. Never configure your server to reply with “*”.
  • There is no anonymity if you allow web sites access to the Geolocation API or local storage.

Jazoon: One Year Of Groovy

26. June, 2008

That was my talk. Attendance could have been better but I guess with Joshua Bloch presenting Java Puzzlers, Cédric Beust with “A quick guide to modern languages and interesting concepts for the busy Java programmer” and Adam Bien with Glassfish at the same time, it wasn’t so bad.

Here is the link to the presentation as OpenOffice document. Feel free to post any comments or questions below.


Public Talk: Quantum Computing (2nd Try)

14. April, 2008

After my back is back, I’ll give the talk about quantum computing this week, Thursday 17th of April. See this page for details.


Public Talk: Quantum Computing [Update]

10. March, 2008

Because of major back pain, I can’t give this talk today. I’ll post a new announcement when I knew the new date. Sorry.

If you ever wanted to meet the mind behind the blog and you happen to be in Zurich on April, 4th, you can. I’ll be giving a public talk about quantum computing for the LUGS (Linux User Group Switzerland). The talk will be in German.

It’s not mandatory to be a member of the LUGS to attend the talk but of course, you’re welcome to become a member of Switzerland’s largest LUG, too.


“What’s Wrong With Java” as OpenOffice Document

19. August, 2007

Since my presentation at the Jazoon is only available as a PDF (and it looks horrible, too), I’ve uploaded the source OpenOffice presentation to my own website. It includes all the additional comments which are missing in the PDF. You can find it here.

For all those who couldn’t attend my talk: This document summarizes a few weaknesses of Java which are solved in Python and Groovy and why I think that Java is now at it’s peak. From now on, it’s going down. Not overnight, of course, and there is no need to rush into any kind of action. But in ten years from now, Java will be where C is today: Something you don’t want to build your career on (that’s Java, the language, not Java, the VM).


Rating of my Talk

30. July, 2007

The rating of my talk at the Jazoon just came in: 2.74 on a scale from 1 to 5. That’s even below average (3 would be average). Hm. Okay, I was sick and tried to put too much information into my 40 minutes. Anything else I can do better next time?