Defcon 23: Let’s End Clickjacking
So, my Defcon talk, ultimately about ending clickjacking by design.
TL:DR: The web is actually fantastic, and one of the cool things about it is the ability for mutually distrusting entities to share the same browser, or even the same web page. What’s not so cool is that embedded content has no idea what’s actually being presented to the user — Paypal could have a box that says “Want to spend $1000” and somebody could shove an icon on top of that saying “$1.00” and nobody could tell, least of all Paypal.
I want to fix that, and all other Clickjacking attacks. Generally the suggested solution involves pixel scraping, i.e. comparing what was supposed to be drawn to what actually was. But it’s way too slow to do that generically. Browsers don’t actually know what pixels are ultimately drawn normally; they just send a bunch of stuff to the GPU and say “you figure it out”.
But they do know what they send to the GPU. Web pages are like transparencies, one stacked over the next. So, I’ve made a little thing called IronFrame, that works sort of like Jenga: We take the layer from the bottom, and put it on top. Instead of auditing, we make it so the only thing that could be rendered, is what should be rendered. It works remarkably well, even just now. There’s a lot more work to do before web browsers can really use this, but let’s fix the web!
Oh, also, here’s a CPU monitor written in JavaScript that works cross domain.
Dan Kaminsky's Blog 
From slide 9: “The SOP can be a problem”…”This is a surprising finding, even to me.”
Come on, you broke it before.
Are you sure there isn’t some DNS-rebinding attacks still possible to printer down the hall ? 😉
I’m sure there are still lots of recurse DNS servers which don’t block internal IPs (and internal IPs are easier to get/guess now with WebRTC).