From: Chad Owen Yoshikawa <chad@CS.Berkeley.EDU>
Date: Thu, 9 May 1996 18:52:17 +0800
To: www-security@ns2.rutgers.edu
Subject: Java Hole: Web Graffiti & Covert Channels
Message-ID: <199605090210.TAA00650@whenever.CS.Berkeley.EDU>
MIME-Version: 1.0
Content-Type: text


--------------------------------------------------------
Web Graffiti & High Bandwidth Covert Channels Using Java
--------------------------------------------------------

While developing a chat server using Java as a frontend, we've
been exploiting what we think is a new Java security hole in
Java-enabled browsers such as Netscape.  The hole allows for
opening sockets to arbitrary ports on web servers that serve
Trojan-horse applets.

We've also used a known security hole (covert channels) first mentioned
in work by the SIP group at Princeton to create what we call
'Web Graffiti' - the dynamic insertion of text, graphics, applets, into 
HTML pages.  

Both of these attacks are three-party attacks and require Trojan-
horse applets.  For a draft of a paper that is work in progress, 
point your browser to:

http://whenever.CS.Berkeley.EDU/graffiti/

Chad Yoshikawa		Brent Chun
chad@cs.berkeley.edu	bnc@cs.berkeley.edu