Your SlideShare is downloading. ×
0
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

Samy Kamkar - Geolocation via XXXSS (2010, cutted part of it)

30,241

Published on

Published in: Technology
0 Comments
3 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
30,241
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
0
Comments
0
Likes
3
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide
  • AMERICA, evercookie, why haven’t you done anything new
  • Probation Honorable people, Probation which was like AOL IRL
  • They know everything. Seriously.
  • How accurate is this?
  • Jack bauer-level triangulation
  • Well, zuckerberg said it best. Privacy is dead
  • Well, zuckerberg said it best. Privacy is dead
  • And that concludes
  • Transcript

    • 1. Who is samy?
      • "Narcissistic Vulnerability Pimp"
      • (aka Security Researcher for fun)
      • Creator of The MySpace Worm
      • Author of Evercookies
      • Co-Founder of Fonality, IP PBX company
      • Lady Gaga aficionado
    • 2. Cyber Warrior
      • Raided
      • Computer use lost (Hackers-style)
      • 700 hours of community service
      • Restitution
      • Probation
    • 3. Geolocation via XXXSS
    • 4. Geolocation via XXXSS
      • Anna visits malicious site
      • XXXSS scans her local network for the type of router she uses
    • 5. Geolocation via XXXSS
      • Anna visits malicious site
      • XXXSS scans her local network for the type of router she uses
      • If necessary, log in with default credentials!
    • 6.  
    • 7. Geolocation via XXXSS
      • Anna visits malicious site
      • XXXSS scans for router type
      • Logs in with default credentials (if necessary)
      • XSS router to load remote malicious JS
    • 8. Geolocation via XXXSS
      • Remote JS uses AJAX to acquire MAC
    • 9. Why MAC Address?
      • Just Bing it!
      • Type www.bing.com in your URL bar
      • Type in “ Google ” in the search box
      • Hit enter!
    • 10. Why MAC Address?
    • 11. Geolocation via XXXSS
      • Upon MAC acquisition, ask the Google
      • See FF source for Location Services
    • 12. Geolocation via XXXSS latitude: 36.0920029 longitude: -123.3461946
    • 13. Geolocation via XXXSS
    • 14. Geolocation via XXXSS
    • 15. NAT Pinning: prevention
      • Strict firewall – don’t allow unknown outbound connections
      • Client side – run up to date browser
      • Client side – use NoScript if using Firefox
      • Client side – run local firewall or tool like LittleSnitch to know if an application is accessing unknown ports
      PRIVACY IS DEAD
    • 16. Fin phpwn: samy.pl/phpwn NAT Pinning: samy.pl/natpin Geolocation via XSS: samy.pl/mapxss Samy Kamkar www.samy.pl [email_address] twitter.com/SamyKamkar * No IRC channels were trolled in the making of this presentation.

    ×