Scary or just what the doctor ordered?

[ClickBuster]

True, but still not very polite.

Here's the deal. First of all, browser version has shit to do with the HELO request my browser is sending to get the damn headers and body that your server sends. Although it's not only HELO, but again it's not the browser version that is important in that case. You're the one that can exploit the browser vulnerability, not the browser that can hack your server (not that you can't hack with browser, I'm not talking about this). The server sends response headers the browser does or doesn't understands depending on the version, etc - there's no chance that your Apache or IIS or whatever you're using is sending different headers depending on the browser version, BECAUSE all popular browsers are made to understand HTTP the way it is now, because it haven't changed for YEARS... or maybe you're saying that IE 4 sends different "give me the page" headers that IE 6.5? There may be some vulnerabilities that are in version 4 and are not in version 6, but that's not the same thing.

Your JS is the one identifying my browser version and redirects me to a server-side app that will do whatever it has to do to send me the proper HTML that is understandable by my browser (if you ever create that kind of code), which although is a good thing, meaning that you (the webmaster) can provide HTML that is compatible to any browser (don't forget that 99% of the Internet doesn't care that much about that kind of things).

However, getting my browser version with JS may lead to the hack. For instance, the surfer have a vuln. browser and is redirected to a script that executes the JS exploit OR the buffer overflow exploit (for example caused by a vulnerable header parser). Well, a hacker wouldn't test this in general and would try to exploit everything he can, but what about version dependent variable values that would complete the hack? What about the fact that OS identification (JS code again) may lead to further attacks. Data collecting is good thing for the hackers as a general meaning, so please, don't explain to me how good it is that my browser can give away all that info for free There're tons of cases that this can be proved bad.

I understand getting plugin version for instance (no matter that most of the time it something like "Flash 5 for Windows XP"), but this is something else.

I want to say something here to the paysite owners that may read this thread. From what I'm hearing and reading about Strongbox - it's a good service, don't get me wrong, that will boost your business and reduce the password exchange, which will increase yours and your webmasters' income for sure.

However Ray, what your company is doing here is that it exploits a major flaw in the browsers themselves and that's a fact, no matter what you'll say. By flaw, please don't understand vulnerability, just something that I find somesort needless or that needs to be replaced with something else that is more secure (which, again, won't happen).

And Ray, I hope you're not offended in any way from this discussion I really enjoy it

Regards and best wishes,
Andrew

PS>
I'm using FireFox

[raymor]

irst of all, browser version has shit to do with the HELO request my browser is sending to get the damn headers and body that your server sends.
...
there's no chance that your Apache or IIS or whatever you're using is sending different headers depending on the browser version, BECAUSE all popular browsers are made to understand HTTP the way it is now, because it haven't changed for YEARS... or maybe you're saying that IE 4 sends different "give me the page" headers that IE 6.5?

BTW, HELO is a part of a POP3 request to retrieve mail.
It's not used by browsers or for web pages. Web browsers
send GET, HEAD, and POST requests.
Perhaps my last message wasn't very clear.
The whole point of my last message is that indeed
almost all web servers respond very differently
to IE (versions 4, 5, 5.5, AND 6) than they do to
other, standards compliant browsers. They do so based
entirely on the request sent by the browser, which looks
something like this:

GET /somepage.html HTTP/1.1
CONNECTION: Keep-Alive
USER-AGENT: Mozilla/4.0 (compatible; MSIE 5.22; Mac_PowerPC)
PRAGMA: no-cache
HOST: www.dcs.napier.ac.uk
Accept-Language: en-gb
Accept-Encoding: gzip, deflate
ACCEPT: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*

There are many other headers that can be included, of course.
The above example has no cookie being returned, no CGI
data, etc. but it's fairly typical of a basic request. It tells us that
it's MSIE 5.22 on PowerPC preferring British English, among
other things.

There's no JavaScript involved I don't know where you got that idea,
or the idea that Strongbox redirects the user to some other web page.
Check your httpd.conf and
you likely to find all of these hacks for IE and many more:
<IfDefine SSL>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive \
ssl-unclean-shutdown \
downgrade-1.0 \
force-response-1.0
</IfDefine>

These particular lines say that if it's IE trying to do SSL
than use HTTP 1.0 and close the connection even though
IE says it can handle keeping the connection open
for the next request. IE can't handle HTTP 1.1 at all
with SSL even though indeed HTTP 1.1 has been the standard
for over 6 years now. IE also sends a keep alive request,
asking the server to leave the connection open for the
next request, but in fact it chokes if the server does that.
You'll see other directives in there that do in fact send
different reponses to IE4 vs. IE5 vs. IE6 precisely because
none of them follow the standards very closely at all and
they don't even all behave the same. If you responded to
IE4 with a response designed for IE6 that would choke IE4.
It's not _supposed_ to ne that way, no. They are all supposed
to speak standard HTTP. But they don't. Not by a long shot.

Some of this is just bugs in IE, MS quality control is not too good.
Some of it is Microsft's written policy of intentionally "warping"
standards such as HTTP and HTML so that people will start designing
pages and servers for IE, in which case they won't work with other browsers.
Remember those icons you used to see on _SO_ many web pages
saying that the page was designed for MSIE? That wasn't an accident.
MS excutives testified that MS worked very hard to make sure that
IE wouldn't accept "generic" standards compliant pages and that
pages designed for IE wouldn't work in other browsers in a largely
succesful attempt to get all pages designed for IE and make sure
that everyone therefore had to use IE in order to use the pages fully.

Strongbox uses no Javascript, so I'm not sure where you're getting that,
and it doesn't exploit any browser vulnerabilities either.
Strongbox simply records and analyzes information to protect
your site.
Personally I don't see it as impolite for Strongbox to record the fact
that so far today the user name "sureimlegit" has logged
in using MSIE 6, Firefox 1.0, and Mozilla 1.7.3, as well as the fact
that on different occasions "sureimlegit" has preferred American
English, British English, and Chinese, so it's probably NOT the
same person loggin in 3 times and the password is probably compromised.

[ClickBuster]

About the HELO thing, I never looked at the HTTP RFC for more info, I just tried "telnet www.greenguysboard.com 80" and typed a HELO to see what happens. The output was the index of the site, which is why I decided my memory is not making jokes with me. However, I'm sure you're correct here as I'm sure that you're very experienced with what you're doing.

I made my conclusion based on the way other systems are logging that kind of information - counters. I know that web counters are getting tons of data using JS, which in the end produces that stats report for the site's usage. I thought you may be working in the same manner, mentioning the fact that I never have looked at your backend, so it's just an assumption.

Thanks for all the information you posted here. It's really interesting. I hope I have time to spend on protocol analysis in order to learn more about the net itself. I have some good experience with server/client side coding and thought I had it all explained in my head, it seems now it's not like this Thanks for your time Ray, I really appreciate the conversation.

Regards,
Andrew