New Hack Weaponizes the Web Cache

guest · Jun 12, 2018

New Hack Weaponizes the Web Cache
Researcher exploits design flaws in Web caching to take control of popular websites, frameworks - and the Mozilla Firefox browser infrastructure.
June 12, 2018
https://www.darkreading.com/vulnera...-hack-weaponizes-the-web-cache/d/d-id/1332027

A newly discovered attack forces Web cache servers to deliver malicious content to website visitors – and also exposes a major security hole in Mozilla's Firefox browser infrastructure.

James Kettle, head of research at PortSwigger Web Security, exploited security weaknesses in the design of website infrastructure to hack the Web caches of major sites and platforms: a US government agency, a popular cloud platform provider, a hosting platform provider, a software product, a video game, an investment firm's investor information, and some online stores.

In his research, Kettle also stumbled on a flaw in an API used in Firefox's infrastructure that allowed him to take partial control of tens of millions of browsers using his cache-attack method. "I call it a low-fat botnet because I didn't have complete control over Firefox, but I had a bit of control," he says.

At Black Hat Kettle plans to release the open-source utility he created for his research, an adapted Burp Suite tool that scans Web infrastructures for cache-poisoning weaknesses, he says.
Click to expand...

Log in or Sign up

New Hack Weaponizes the Web Cache

guest Guest

Log in or Sign up

New Hack Weaponizes the Web Cache

guest Guest

Useful Searches