there’s a writeup of this kind of attack @ gnucitizen by sirdarckcat with code samples.

link: http://www.gnucitizen.org/blog/ghost-busters/

I’m not trying to spread FUD at all, I’m more clueless than clued in. But I was under the impression that the explicit attack vector was not discussed. Honestly interested if anyone can confirm or deny that.

I do understand that Manuel works there and I agree that if the initial attack was described they must have already patched it. But I also know that undisclosed internally known attacks do at times remain open.

I asked about slides and was told there were none, but that audio of the talk should be available some how, but i didn’t get a follow up about it. If that’s true does anyone know how to get a recording of the talk?

However, whether or not the issue is entirely fixed in IE7 is another story.

@ Mark: No, but we’ll update with a new post once we get more information.

Smart people are already at work on trying to fix XSS, CSRF, and other SOP problems in browsers and Flash, etc. Unfortunately, the problem/fix doesn’t always seem to be on their side of the equation. The problem is really a problem with the initial designs inherent in HTML, HTTP, Web Services, and the code that is produced to create applications that use these technologies.