Exploiting the Google App Ecosystem

Dietrich Kappe, Monday, July 24, 2006 @ 9:00 am

A number of readers have noted that XMLHttpRequest can only communicate back to the same host that served up a page. This is true. We've all played around with XMLHttpRequest to see if we could make it break. Barring browser bugs, even with iframe and document.domain hacks there isn't much you can do. You can use the super twin powers of Flash to do cross domain scripting in some cases, but even that has its limitations. So we're safe, right?

As I pointed out last week, sites that allow for the persistence of executable artifacts -- Javascript scripts and Flash files -- can provide a leading wedge for AJAX worms and viruses. Many of these same sites have various forms of messaging, such as email. If you can push the buttons on these apps, you don't have to make cross domain XHR calls at all. So, is an application like Yahoo or Google mail "scriptable" enough to allow this sort of subversion?

I know that reading through code like this

function qG(a,b,c,d){Dn(a,d);a.open(b,c,true)}
function rG(a,b,c){a.setRequestHeader(b,c)}
function pG(a,b,c){b=Hc(b);jh(a,b,c)}
function jh(a,b,c){Dn(a,c);a.open("GET",b,true);Cn(a,null)}
function Tt(a,b,c,d){Dn(a,d);a.open("POST",b,true);Cn(a,c)}

may make you feel confident that no one could decipher the inner workings of Gmail, but remember the old cracker war cry: "Security through obscurity is no security at all." What man has compiled, man will also decompile -- the Google Web Toolkit will give up its secrets.

With this in mind, I would be much more at ease if all of the various google applications I use -- maps.google.com, spreadsheets.google.com, mail.google.com, and the various apps under www.google.com -- didn't all have single sign-on and the same google.com domain. It makes for a better experience, to be sure, but I'm pretty certain I don't want someone mailing my spreadsheets to a compromised mailbox.

In the olden days, a popup browser window that started behaving strangely was a dead giveaway that foul play was involved. These days there is no window or status bar message and email may be going out in your name that you don't even know about.


Topics: , , ,

agile ajax Agile Ajax

Comments

None so far.

Leave a comment

Powered by WP Hashcash

About Pathfinder

Follow the Blog

    Get a monthly update on best practices for delivering successful software.

    Subscribe via email

      

    Subscribe via RSS      RSS icon

Categories

Topics

Blogroll

Search

WordPress

Comments about this site: info@pathf.com