Hacking public-information kiosks
Public-information kiosks are supposed to allow users to find out more about a company or government agency, and that's all. But on Saturday afternoon, Shanit Gupta, a senior consultant at McAfee Foundstone, demonstrated several ways that he and others have been able to map the internal network on a system running XenApp, formerly Citrix Presentation Server.
On the demonstration screen at ShmooCon, an East Coast computer hacking conference, Gupta showed how the familiar toolbars and browser frame are missing on a system running XenApp. The idea is that on a kiosk the public can click on links only within the single page. But if there's a keyboard or a mouse present, which there often are, Gupta was able to open additional sites, exposing the internal network.
Starting with Ctrl-H, he was able to pull up the browser's history. If the history revealed no outside search engines like Google, one could also type Ctrl-O and then type in Google there. If all else fails, one could also hit Ctrl-N and open a new tab, which will show the usual address bar and toolbar for navigation.
Opening a Web site not on the public tour could allow an attacker to download and install NMAP and run a port scan of the internal network. If the browser supports Javascript, one could also run a Javascript port scanner.
Typing Ctrl-P calls up the printer; however, Gupta pointed out that you can also save to file there and, while doing so, see the internal network.
No keyboard, no problem. Gupta says simply right click on any image and chose Save As ...
Gupta's demo concluded prematurely, hampered by an overall loss of Internet connection at the conference.
Citrix says on its site that when running XenApp, "built-in endpoint scans and policy controls take into account each user's role, device characteristics and network conditions to determine which applications and data they are authorized to access." However, Gupta said that the flaws were first called to his attention at a government agency. Using the standard Internet Explorer keyboard hot keys, Gupta and partner were able to see inside the agency's network.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
May I venture to guess that the author is a Mac user, unaccustomed to keyboard shortcuts?
Evidenced by the fact that these functions on a Mac are provided by the Operating System directly, typically not requiring your application code to implement such functionality. Windows requires you define your own undo procedures, to respond to the Undo message, which can be incredibly complex. The Mac implmentation is much more efficient, usually requiring little effort on the programmer. Another useful feature Macs have, the revert command, which typically reloads from the saved version of a file. Do not decieve yourself, there are many things that Macs currently do that PC's still only dream about, especially in multi-media production and broadcasting.
I agree the author probably does not know anything about real hacking.
- This is Not Hacking, which is even worse.
- by chash360 February 19, 2008 10:43 AM PST
- First, Ctrl or Command key sequences are typically not considered hacking, by any stretch of the imagination.
- Like this Reply to this comment
-
(8 Comments)Second, what a joke security must be for these, even simple procedures, to puncture through security. I keep hearing about software vendors focusing on security but its all PR Crap. I have not seen one solid attempt at real designs for security since multics, abandoned by MIT decades ago. Without user AND process permission sets, its going to be a difficult road. With no competetion for M$ it will be impossible as they have no economic motivator to produce long lasting, secure, stable, reliable code. However would they sell their many upgrades, and keep so many H1B's so gainfully employeed in making patches and updates?
I am almost convinced we have completely lost all competence in really secure software architectures, I have not seen any for some time, and its not like its hard to improve current designs, they do not set the bar very high....
Is it just a repeated 'patch and release' attitude of software vendors? Or is it because corperate america decided that coders (as well as other IT workers) were lower class labor, to be commoditized and outsourced to cheap labor countries? Hmmmm... some of both?????