OHM 2013: The quest for the client-side elixir against zombie browsers
Channel: Christiaan008
Date: 2014-06-12

For more information visit: http://bit.ly/OHM13_web
To download the video visit: http://bit.ly/OHM13_down
Playlist OHM 2013: http://bit.ly/OHM13_pl

Speaker: Zoltan Balazs

Hacking client side protection systems (sandboxes, internet security suites, financial endpoint protection systems) with malicious browser extensions.

In 2012 I have created and published proof-of-concept malicious browser extensions for Firefox, Chrome and Safari. With these, one can steal cookies, passwords, spy on webcam, use the browser as a proxy, change financial transactions in the background, steal files, and many more malicious things. In this presentation I will investigate the internet security suites, "safe browsers", sandboxes and how they (don't) protect against malicious browser extensions running in user space. In the second part of the presentation I will hack the "financial endpoint protection systems" usually offered by financial institutions with phrases like "Use this and you'll be safe".

My presentation will be about a unique research on how the "hacking game" is shifting from the operating system to the browser, how the current solutions work and how they can be circumvented. Three hacking demos will be shown, two including Paypal.