"Java tried to make a Start. Java Programs run in an Sandbox which is supposed to be secure. So is ActiveX Scrpting supposed to only use Secure Objects. But the History tells us, that even that simple task of building a small sandbox for Web Applets is impossible to do for the vendors. All kinds of Javascript, Web Spoofing, ActiveX unsecureness or Java Sandbox Exploits are known."

..Killer Java applet sacks NT systems

  Whatever you do, don't push that big red button

    On August 14 a Norwegian programmer discovered how to write a Java
    applet that, when run, can bring down a Windows NT system. This is
    not supposed to be possible, of course. Tonny Espeset esp2@online.no
    accomplishes the trick by calling some Java methods with out-of-
    bounds arguments (the exploit page does not give details), and on
    about half of the NT systems tested the applet immediately crashes
    the system right down to a white-button reboot. On some other NT
    systems, running the applet corrupts system fonts and cursors; the
    symptoms are cured by a reboot. I tried the applet [19] on two NT
    4.0 systems and crashed one, corrupted fonts on the other.

    Greg Roelofs roelofs@pmc.philips.com, TBTF Irregular, tipped this
    story -- thanks.

    [19] http://www.eyeone.no/KillerApp/KillerApp.htm

    For a complete list of TBTF's (mostly email) sources, see
    http://www.tbtf.com/sources.html.
    ________________________________________________________________________

    TBTF home and archive at http://www.tbtf.com/. To subscribe send
    the message "subscribe" to tbtf-request@world.std.com. TBTF is
    Copyright 1994-1998 by Keith Dawson, . Com-
    mercial use prohibited. For non-commercial purposes please forward,
    post, and link as you see fit.
    _______________________________________________


More java problems reported by TBTF:

  Rewriting the interface to steal your account

    A programmer in Canada discovered a way to steal Hotmail users'
    login IDs and passwords [30]. The exploit uses JavaScript to rewrite,
    transparently, part of HotMail's Web interface for email. When a
    victim receives an email message containing the Trojan-horse Java-
    Script and reads it in the HotMail account, s/he is prompted to re-
    enter name and password, which have supposedly expired. This dia-
    log looks like an official HotMail request. The name and password
    are captured and emailed to the perpetrator. Here is the discov-
    erers' exploit page [31]. Microsoft and HotMail were notified of the
    vulnerability and worked at top speed on a fix. When they posted
    what was billed as a "partial fix" (filtering out JavaScript code)
    on 8/24, the exploit's discoverer quickly put up a workaround that
    causes the same end result [32]. (He hid the JavaScript code within
    IMG tags.) Other Web-based free email services are also thought to
    be vulnerable to this exploit. Users of such services might consid-
    er doing without JavaScript for now.

    [31] http://www.because-we-can.com/hotmail
    [32] http://www.news.com/News/Item/Textonly/0,25,25657,00.html?tbtf
         This link no longer available.
 

..A comparison of virus scanners

  Surprised? They're not all equally effective

    Shake Communications Pty Ltd. has released the results of an indepen-
    dent study of the top 20 virus-scanning products on the market. Here
    are the press release [14] from Shake and coverage in an Australian
    newspaper [15]. The complete results appear in the September issue of
    the Shake Security Journal [16], a semi-monthly, subscription-based
    publication (3 issues US$25, 6 issues US$40).

    The study tested each product in a "hot zone" of 16,000+ viruses --
    including executables, Word and Excel macro viruses, Microsoft Ac-
    cess viruses, Lotus 123 viruses, Trojans, and bait files. (So they
    say; I don't know what "bait files" means.) Shake says that few of
    the programs performed consistently across all virus categories.
    The company cautions that a product's ranking on this list is only
    one of a number of factors to consider when choosing a scanner. Here
    is a capsule of the survey's results, in terms of the percentage of
    viruses detected. Thanks to Simon Johnson 
    for forwarding this table, not available in the cited public sources.

        1   Anywhere Anti-Virus       99%
        2   F-Secure                  94%
        3   Norton Anti-Virus         93%
        4   Find Virus (Dr Solomon's) 93%
        5   Inoculan AntiVirus        93%
        6   Avast                     93%
        7   McAfee VirusScan          91%
        8   Thunderbyte               91%
        9   LANDesk Virus Protect     90%
        10  Sophos                    88%
        11  AntiViral Toolkit Pro     87%
        12  House Call                86%
        13  ViruSafe                  79%
        14  Vet                       73%
        15  Virus & Macro Buster       2%
       +-
       | 16  Quick Heal               n/a
       | 16  Panda Anti-Virus         n/a
       | 16  Guard Dog                n/a
       | 16  Fiber                    n/a
       +-

    [14] http://www.shake.net/press/070998.html
    [15] http://www.theaustralian.com.au/techno/4001410.htm
    [16] http://www.shake.net/products/journal/
    ________________________________________________________________________

    TBTF home and archive at http://www.tbtf.com/. To subscribe send
    the message "subscribe" to tbtf-request@world.std.com. TBTF is
    Copyright 1994-1998 by Keith Dawson, dawson@world.std.com.
    Commercial use prohibited.  For non-commercial purposes please forward,
    post, and link as you see fit.
    _______________________________________________
    Keith Dawson               dawson@world.std.com
    Layer of ash separates morning and evening milk.

4:00 p.m. Aug. 24, 1998 PDT

If the message is coming through the Web-based email service Hotmail, it could contain a Trojan horse ready to release your account information to an intruder.

Tom Cervenka, a Web programmer at Canadian Specialty Installations, spent last week working on some clever coding to send to his Hotmail account. It tells users account access has been timed out and that they need to re-enter their account and password information.

When the user clicks the button to resubmit the information, the account ID and password are sent to the email address included in the JavaScript.

If successful, his code would tell users their account access had been "timed out" and that the user needed to re-enter their account and password information. At that point, the code, in the form of JavaScript, would use standard mail protocols to send the account data to any email address. His trick worked.

"I found out I could send myself a message that could contain JavaScript code. The code could go and alter the Hotmail user interface itself," Cervenka said. "Pretty much once you view the code [in the email message], it starts reading ... and the damage is done."

The JavaScript applet in question was capable of altering the HTML-based interface of Hotmail's inbox, its outbox, and its message controls. The links and interface looked the same after they had been altered, but they had been changed to send data to Cervenka's address.

"We can verify that it does appear to work and is a way that people could potentially sniff a user's passwords, and we're working extremely hard on coming up with a fix for it," said Sean Fee, Hotmail's director of product marketing.

"We don't have a specific time, but we would expect a very, very fast turnaround on this," Fee said.

Until then, Hotmail users shouldn't open email messages from unknown senders, and they should disable JavaScript in their Web browser.

Cervenka posted a working demonstration and full description of the exploit on the Web, and sent out alerts to security mailing lists.

He doesn't know of other successful exploits of the trick, but figures he's not likely to be alone in discovering what he says is the use of fairly simple JavaScript instructions to fool the Hotmail system. The free email service is the only one he's tested it on, but Cervenka suspects that any Web-based email or chat system can be similarly exploited. The fix, he says, is for the systems to detect and filter out JavaScript from any incoming email messages.

"If I've figured it out, there's definitely a lot of other people who have figured it out, too," he said.

"If anybody doubted that they should be concerned about their use of JavaScript, now they know," said Ted Julian, security analyst with Forrester Research.

"It's a classic Trojan horse that's been tried with many different kinds of applications as a way to gather [usernames and passwords]," Julian said.

Cervenka said he alerted both Hotmail and Microsoft at the end of last week but received no reply other than an automated email response from Hotmail.

"Anyone that knows even a minimal amount of JavaScript can take advantage of this."

Julian said free email service providers also need to be aware of the liability issues.

"It's great that they are putting together these portals that contain all sorts of information and services as a way to attract traffic, but here's an example of how they need to think very carefully about what the security and liability issues are that are associated with those services," said Julian. "It's not just a matter of kinda throwing this stuff up there now. There's some considerations that they need to make."

Fee said that the company is working hard to "understand exactly the various ways in which it works, understand its technical scope, and come up with a solution" that will remedy the problem.

"Protecting our members' personal email and privacy is of paramount importance to us," Fee said.

In February, the company patched within a day a potential exploit that granted malicious users access to Hotmail accounts.