Hacking: The Next Generation

Stealing Files from the Filesystem

Up until this point, the examples we have presented have focused on stealing a victim’s online information, data, and documents. Although more and more organizations and individuals continue to embrace the benefits of online storage and collaboration portals, many organizations and individuals remain leery of some of the dangers associated with online storage, online document repositories, and collaboration portals. These organizations and individuals prefer the safety and control of their own computer system and store all of their sensitive documents on their local hard drive. In essence, such organizations fall back into the perimeter-based model by restricting information behind a set perimeter, in this case their local desktops.

Businesses, no matter how restrictive in terms of policies, must allow their employees to use web browsers to access information online. Although every major browser has security mechanisms that prevent remote sites from accessing content stored on the user’s local filesystem, these security mechanisms are not foolproof, and from time to time weaknesses in implementation create opportunities for remote hackers to steal an organization’s data right off the desktop of even the most protective employees. In this section, we will demonstrate real-world vulnerabilities that we discovered, some of which can allow attackers to use a victim’s web browser to steal sensitive documents from the local filesystem!

Safari File Stealing ...