Re: CERT Advisory CA-97.20 - JavaScript Vulnerability

Drew Dean (ddean@CS.PRINCETON.EDU)
Fri, 11 Jul 1997 14:36:02 -0400

From: Jauder Ho <jauderho@carumba.com>

> It's pretty funny that people are actually considering this a
> webspoofing technique this late. I wrote something like this back in 95 as
> something fun. Basically I took a url, sucked in down, parsed the data
> through chef (for those of you who don't know what this is, it's a lex
> proggie that translates everything you pass to it in to mock swedish a la
> the Muppets :) and from then on you can navigate the web in mock swedish!
> :) I can post the perl source if there is interest except it wil take some
> work to get it working again. I would prefer to rewrite it using CGI.pm :)
>
> turtle%texturizer% ls -l hmm.cgi
> -rwxr-xr-x 1 jauderho staff 6050 Dec 5 1995 hmm.cgi*
>
> --Jauder

That sounds like the Zippy the Pinhead filter, which we used as a
basis for our first generation prototype. We went substantially beyond
that, however. (We went through 3 prototypes before settling on our
current architecture and implementation.) We use JavaScript to put
the original URL on the status line when you roll your pointer over a
link. We pop up a new window (also courtesy of JavaScript) over your
existing browser window, and spoof the location line as well. (Yes,
the pulsating "N" works just like normal in our window, too.) We also
get the blue key to light up when you follow a https: link.

In other words, we've done a _lot_ more than a simple URL-rewriting
CGI script. While our emulation isn't perfect, it works well enough
to show that there are no insurmountable problems left. Since we did
this as a research project, that's a good time to write the paper and
move on. As academics, we've cited all the relevant previous work
that we were aware of. (Obviously, if it's unpublished, we can't cite
it.)

Please read the paper for more details.
http://www.cs.princeton.edu/sip/Publications.html

Drew Dean

PS: Please excuse typos. I'm in California, not New Jersey, at the
moment, and have a very bad network connection.