1. XSS Without the Browser Wait, what? Toorcon Seattle, 2011

2. # whoami  Kyle Osborn…. Many know me as Kos.  http://kyleosborn.com/  http://kos.io/  @theKos  Application Security Specialist at WhiteHat Security

3. HTML Rendering Engines  Trident – Windows (Internet Explorer)  Webkit – OS X (Safari)  Easily embedded.  Easy to update, add features, style, and include advanced user interaction with HTML, JavaScript and CSS.  HTML5 features offer a more seamless desktop interface.  Very Cheap! HTML/JavaScript/CSS are simple.

4. Web vulnerabilities… In Desktop Applications Conventional web vulnerabilities can now become desktop vulnerabilities. Forget shellcode, my payload is JavaScript! My exploit isn’t a buffer overflow, it’s double-quotes! Binary foo? More like “I once made a website for Grandma’s knitting company”-foo. What does this mean? Fixed in latest versions of Skype >= 5.0.922

5. So what, it’s just a little JavaScript! Same Origin Policy  Dictates that JavaScript can not reach content in another context.  Origin based on:  Protocol (http, https)  Hostname (google.com)  Port (:80)  protocol://hostname:port/ But….  The Same Origin Policy is based on an Origin.  What is the “origin” inside desktop applications?  No protocol  No hostname  No Port  So…

6. Demo #1 (or video…) [picking on Skype]  Payload:  Injects an iframe with Google into the chat DOM.  Injects into the iframe.  Uses Safari cookies and sessions in requests.

7. Demo #2 (or video…) [picking on Skype]  Payload:  XmlHttpRequest opens file:///etc/passwd and then alerts itfile:///etc/passwd  Can access any files on the local filesystem that the user has permission to read.  Also works for https://mail.google.com/https://mail.google.com/  Can be used to bypass CSRF tokens and requests can be crafted to essentially do anything.

8. Basically… If Origin = null… then BAD  If the “origin” doesn’t exist, what is there to compare to?  Since http://www.google.com:80/ === nullhttp://www.google.com:80/ JavaScript isn’t really breaking an rules  As far as I can tell, just a misconfiguration on the developers side. My point is: The outcome can be very bad, applications like this should be tested.

9. Where to look OS X  Adium  iChat  Twitter.app  Skype  ….. Windows/Linux  gwibber (Linux twitter client)  AIM  …there has got to be more

10. Information  Talk to me later. I’ll be around for the parties, and Black Lodge tomorrow.  http://kos.io/skype (will be updated with slides and more info) http://kos.io/skype  Twitter @theKos  Blog coming soon @ http://blog.whitehatsec.comhttp://blog.whitehatsec.com