Fast-typing attendee has a naive moment, and then Digg kicked in
IDG News Service - Software that could be used to turn a Web browser into an unwitting hacker's tool has been posted to the Internet, after it was downloaded by a quick-thinking attendee at last month's Shmoocon hacker conference.
However, in order for his demonstration to work, he had to post the Jikto code somewhere on the Internet. "Very briefly you could see the original URL of where the Jikto code got fetched," Hoffman said.
That was enough for show attendee Mike Schroll to snag a copy.
"I was sitting pretty close to the front and had my laptop out already," said Schroll, an information security consultant at Security Management Partners Inc. "The second I saw it i just started typing away."
Schroll posted the code on his Web site March 25, and submitted a link to the code on Digg.com. He removed the software several hours later at Hoffman's request.
Schroll said he posted the code because he thought it would be useful to other security professionals looking for ways to illustrate just how dangerous a scripting attack can be. "I was pretty interested in it because we do some engagements with clients where we do fake phishing sites," he said. "I wasn't trying to be nefarious or malicious."
The software was downloaded from his Web site about 100 times, Schroll said.
Over the past weekend, the code surfaced again, this time on the Sla.ckers.org online discussion forum.
With Jikto now public, security researchers worry it could be misused by criminals to scan internal networks for sensitive information, or to build a malicious botnet code. "This particular tool is designed to take control of the Web browser," said Jeremiah Grossman, chief technology officer at WhiteHat Security Inc. "It will crawl other Web sites and scan them, looking for vulnerabilities."
Hoffman was sanguine about the release of his tool, saying that criminals would probably have been able to develop something similar to his short, 800-line application.
"It's kind of a tragedy that this ended up getting released," Hoffman said. "But in reality the bad guys probably knew this and even if they didn't have it they were probably a couple of months away."
He said he's not angry at Schroll for snagging and releasing the Jikto code. "He probably did what any curious individual would have done," Hoffman said. "I really can't fault someone for being curious because that's what my job is."
[Editor's note: This story was originally posted with an incorrect spelling of the word Jikto. It was updated on April 2 to correct the spelling.]
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts