Client-Side Attacks and Defense

Front cover......Page 1
Client-Side Attacks and Defense......Page 2
Copyright......Page 5
Dedication......Page 6
Biography......Page 8
Contents......Page 10
Client-Side Attacks Defined......Page 14
 Client-Side Attacks: An Overview......Page 16
  Why Are Client-Side Attacks Successful?......Page 27
  Motivations Behind Client-Side Attacks......Page 28
  Confidentiality Impact......Page 30
   Clipboard Attacks......Page 31
   Client Scanning......Page 32
   Drive-by-Pharming......Page 33
   Denial-of-Service (DoS)......Page 34
   Pop-Ups and Pop-Unders......Page 35
 Summary......Page 36
 What Constitutes a Client-Side Attack?......Page 38
  Initiating an Attack: A Look at Cross-Site Scripting (XSS)......Page 40
   The Net Result......Page 46
  The Threats of Cross-Site Scripting......Page 47
  Anatomy of Some Potential Attacks......Page 48
   Theft of Information in User Cookies......Page 49
  Other Client-Side Attacks......Page 52
  Vulnerabilities that Lead to Client-Side Attacks......Page 59
 Reference......Page 61
Protecting Web Browsers......Page 62
 Common Functions of a Web Browser......Page 63
  Features of Modern Browsers......Page 64
  Features......Page 65
  Security......Page 69
  Add-ons and Other Features......Page 72
   Known Security Flaws in Internet Explorer......Page 74
  Features......Page 75
   Platform Support......Page 76
  Security......Page 78
  Add-ons and Other Features......Page 80
   Known Security Flaws in Firefox......Page 82
  Features......Page 83
  Security......Page 85
   Known Security Flaws in Google Chrome......Page 88
  Features......Page 89
  Security......Page 91
   Known Security Flaws in Apple Safari......Page 93
  Features......Page 94
  Add-ons and Other Features......Page 96
   Known Security Flaws in Opera......Page 98
 Web Browsers as a Target......Page 99
  Selecting a Safe Web Browser......Page 100
 Summary......Page 102
Security Issues with Web Browsers......Page 104
  Many Features, Many Risks......Page 105
   JavaScript......Page 106
   Cascading Style Sheets (CSS)......Page 108
    Exploiting Internet Explorer (IE)......Page 109
    Exploiting Firefox......Page 112
   Limits on Browsing History......Page 113
  Tabnapping......Page 114
  Is Private Really Private?......Page 116
 Summary......Page 118
 What is Active Content?......Page 120
   Java and ActiveX Controls......Page 122
  Microsoft Silverlight......Page 123
  ActiveX......Page 126
  Java......Page 131
  JavaScript......Page 135
  VBScript......Page 139
  HTML 5......Page 140
 Summary......Page 141
Advanced Web Browser Defenses......Page 142
 A Mix of Protective Measures......Page 143
  A Mix of Potential Threats......Page 144
  A Review of Browser Features and Security Risks......Page 145
    Securing ActiveX......Page 146
   Oracle Java Related Risks......Page 148
    Java’s Security Model......Page 149
    Securing Java......Page 150
    Securing JavaScript......Page 153
    Securing Adobe Flash......Page 157
  Browser-Based Defenses......Page 159
    Sandboxing......Page 160
    Privacy Settings......Page 161
    SmartScreen Filter......Page 163
    InPrivate Browsing......Page 164
    Security zones......Page 165
    Content Advisor......Page 167
    Crash Protection......Page 168
    Forget this Site......Page 169
    Add-ons......Page 170
    Anti-virus Integration......Page 171
    Safe Browsing and Content Control......Page 172
    CSRF Protection via Origin Header......Page 173
   The Role of Anti-virus Software......Page 174
   The Role of Anti-Spyware......Page 175
 Summary......Page 176
Messaging Attacks and Defense......Page 178
 Evolution of the Email Client......Page 179
  Present Day Messaging Clients......Page 181
  Email Client Programs......Page 183
   Mail Processing......Page 187
   Client Server Interaction......Page 193
  Sending and Receiving Mail......Page 194
  Webmail......Page 196
 Messaging Attacks and Defense......Page 197
  Spam......Page 198
  Malware......Page 199
  Denial of Service (DoS) Attacks......Page 200
  Hoaxes......Page 202
  Phishing......Page 203
 Summary......Page 205
Web Application Attacks......Page 208
 Understanding Web Applications......Page 209
   Microsoft ActiveX......Page 213
    Security Issues with ActiveX......Page 215
   Oracle Java......Page 216
    Security Issues with Java......Page 217
   Microsoft Silverlight......Page 219
    Security Issues with Silverlight......Page 220
   JavaScript......Page 221
    Security Issues with JavaScript......Page 222
   VBScript......Page 223
    Security Issues VBScript......Page 225
   Seamless and Simplified Upgrade Process......Page 226
   Anytime, Anywhere......Page 227
   Licensing Control......Page 228
 Web Application Attacks and Defense......Page 229
  Format String Vulnerabilities......Page 230
  Username Enumeration......Page 231
  Personal Information......Page 232
  Financial Data......Page 233
 Summary......Page 234
 Mobile Attacks......Page 236
 Mobile Devices and Client-Side Attacks......Page 237
  Communication Types......Page 239
   Wireless Networking......Page 240
   Bluetooth......Page 241
   Apple......Page 242
   Google......Page 244
    RIM......Page 247
   Malware......Page 248
   Web Browser Exploits......Page 249
   Denial of Service (DoS) Attacks......Page 251
   Apps/Web Applications......Page 252
 Summary......Page 253
Securing Against Client-Side Attack......Page 256
  Planning for Security......Page 257
  Web Application Security Process......Page 259
  Securing Infrastructure......Page 261
  Securing Applications......Page 263
   Security-Enabled Applications......Page 264
  Digital Signatures......Page 265
  Digital Certificates......Page 266
  Reviewing the Basics of PKI......Page 267
  Testing Your Security Implementation......Page 268
   Application Security Implementation......Page 270
  Malware Protection......Page 272
   Worms......Page 273
   Macro Virus......Page 274
    Hoaxes......Page 275
   Anti-Virus Software......Page 276
 Summary......Page 279
 A......Page 282
 B......Page 283
 C......Page 284
 E......Page 285
 I......Page 286
 J......Page 287
 M......Page 288
 S......Page 289
 W......Page 290
 Z......Page 291