JavaScript botnet code leaked to Internet

JavaScript code that could turn a browser into an unwitting hacker's tool has been released

Software that could be used to turn a Web browser into an unwitting hacker's tool has been posted to the Internet, after it was downloaded by a quick-thinking attendee at last month's Shmoocon hacker conference.

The software, called Jikto was written by Billy Hoffman, lead researcher at Spy Dynamics. Hoffman demonstrated the code on March 24 as part of a presentation on the dangers of JavaScript malware.

Hoffman had discovered a way to write a Web vulnerability scanner in JavaScript, a Web language that can run in any browser. This technique circumvents JavaScript's security restrictions and, concerned that his Jikto code could be misused, Hoffman says he took extra steps to prevent the code from getting out.

However, in order for his demonstration to work, he had to post the Jitko code somewhere on the Internet. "Very briefly you could see the original URL of where the Jikto code got fetched," Hoffman said.

That was enough for show attendee Mike Schroll to snag a copy.

"I was sitting pretty close to the front and had my laptop out already," said Schroll, an information security consultant with Security Management Partners. "The second I saw it i just started typing away."

Schroll posted the code to his Web site March 25, and submitted a link to the code on Digg.com. He removed the software several hours later at Hoffman's request.

Schroll said he posted the code because he thought it would be useful to other security professionals looking for ways to illustrate just how dangerous a scripting attack can be. "I was pretty interested in it because we do some engagements with clients where we do fake phishing sites," he said. "I wasn't trying to be nefarious or malicious."

The software was downloaded from his Web site about 100 times, Schroll said.

Over the past weekend, the code surfaced again, this time on the Sla.ckers.org online discussion forum.

With Jikto now public, security researchers worry it could be misused by criminals to scan internal networks for sensitive information, or to build a malicious botnet code. "This particular tool is designed to take control of the Web browser," said Jeremiah Grossman, chief technology officer with WhiteHat Security. "It will crawl other Web sites and scan them, looking for vulnerabilities."

Hoffman was sanguine about the release of his tool, saying that criminals would probably have been able to develop something similar to his short, 800-line application.

"It's kind of a tragedy that this ended up getting released," Hoffman said. "But in reality the bad guys probably knew this and even if they didn't have it they were probably a couple of months away."

He said he's not angry at Schroll for snagging and releasing the Jitko code. "He probably did what any curious individual would have done," he said. "I really can't fault someone for being curious because that's what my job is."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?