Dirty purty Toolbars

[FrankB]

Hello all,

Not two days ago i almost had that uncomfortable anxious feeling of having `hacked` a famous Belgian Online newspaper's toolbar. ( www.lesoir.be )

They have that "Add our Toolbar [with RSS etc..]" adie, i installed it and didn't like the overwhelming aspect of it, so i wisely uninstalled it and then, then!, i saw something prone to danger :
- i was redirected to a page ( lesoir.ourtoolbar.com/Default.aspx ) where i could customise my/their own toolbar ... cool..
For a moment i thought they had forgotten a security issue in the style of usename/password, they had NONE, and i customised their toolbar making it mine and making it redirect to RSS feeds and entries of searchengines and dynamic webpages of my own choice..
But no, the name of my/their toolbar had a new name and is fully functionable, it was not the newspaper's toolbar i modified but i fresh new one i made .. still all with the very URL lesoir.ourtoolbar.com !!
(when finished it redirected to mytoolbar.ourtoolbar.com, but still ...)

Just go to www.ourtoolbar.com and make your own ...
Do you copy ?? Do you all see the potential exploits one can make with such things ??
phishing, homepage hijacking and spam have yet another oportunity to spread (
( ask for directive in PM, it is freakiy !!)


Nothing happened : i didn't hacked anything and i hadn't f*cked up the newspaper's toolbar at all.
The idea though, how easiily one can fool people with that thrills me !

--
FrankB

[bad_brain]

that's the reason why I avoid toolbars at all costs, in theory it would be no problem to bind a remote shell to the browser by using a corrupted toolbar.....it would act like a rootkit and would show up as browser process in taskmanager and netstat, so only a professional would be able to find it (maybe). create a fake google site and offer your own corrupted "google toolbar"...it is even easier for the "secure" browsers which use the Gecko engine like Firefox, I've read about methods which spoof a whole website including the browser window.
and the idea of enabling everybody to spread own toolbars without ANY control is scary, enough people out there which will use this opportunity for malicious activities (and because the platform is provided no real coding skills are needed, a skiddie's dream).
would be nice if you would give me a little nore info via PM...for good old educational purposes of course...

[z3mwaz]

My My, i dont know much programming but i do think about all possibilities,
And if i know more than i do i could really F**K somethings up (sorry for the language)
but realy think about how many people use [edited]...[/edited] (i cant even say the name)
convincing poeple to use "My New Tool Bar" would not be hard.
and it could be devistating

Oh my GOD


i cant even talk about that, i may try my idea.
sorry folks for the lack of info, but you know how it is when you may have 0Day

be back later