Sciweavers

Share
CCS
2009
ACM

XCS: cross channel scripting and its impact on web applications

9 years 9 months ago
XCS: cross channel scripting and its impact on web applications
We study the security of embedded web servers used in consumer electronic devices, such as security cameras and photo frames, and for IT infrastructure, such as wireless access points and lights-out management systems. All the devices we examine turn out to be vulnerable to a variety of web attacks, including cross site scripting (XSS) and cross site request forgery (CSRF). In addition, we show that consumer electronics are particularly vulnerable to a nasty form of persistent XSS where a non-web channel such as NFS or SNMP is used to inject a malicious script. This script is later used to attack an unsuspecting user who connects to the device’s web server. We refer to web attacks which are mounted through a non-web channel as cross channel scripting (XCS). We propose a client-side defense against certain XCS which we implement as a browser extension. Categories and Subject Descriptors K.6.5 [Management of Computing and Information Systems]: Security and Protection General Terms Sec...
Hristo Bojinov, Elie Bursztein, Dan Boneh
Added 19 May 2010
Updated 19 May 2010
Type Conference
Year 2009
Where CCS
Authors Hristo Bojinov, Elie Bursztein, Dan Boneh
Comments (0)
books