Showing posts with label browser. Show all posts
Showing posts with label browser. Show all posts
Monday, September 25, 2017
Tracking of potentially interesting data in a browser extension
Tracking of potentially interesting data in a browser extension
Intro
As noted in my last post, the next step is to identify potentially interesting data that the browser extension can track and analyze during a web browsing session. At this point, were not completely sure which data will be useful to us, so listed below are some of the potentially most interesting and useful things to track. A small Google Chrome extension is created as a proof of concept, which will be described as well as the Chrome extension architecture.
What to track
Network traffic
Since our goal is to write a IPS for the browser, tracking network traffic is obviously a requirement. During normal browsing, its possible to see the network requests in Chrome DevTools:
 |
| Chrome DevTools |
Browser extensions can use the chrome.webRequest API to catch network requests. During the life
cycle of a web request, several events are fired which we can use to analyze the traffic and decide what to do with the request. The event life cycle is shown in the image below:
 |
| Event life cycle in Chrome API |
The granularity of those events enable us to, for example, catch and log the request between sending it to the remote server, and then analyze the response when it arrives. Or alternatively, if the requested domain is known to be malicious, the request can be denied completely. Logging every HTTP request made during browsing will be very useful for statistically analyzing the data later.
CPU and memory usage
Using experimental.systemInfo.cpu and chrome.experimental.processes its possible to track CPU and memory usage per process/tab. In the learning process, during normal browsing, extension will track the usage and try to establish the average CPU/memory usage as a baseline and will later compare the usage during browsing to that baseline.
The idea is that some malicious sites will try to max out the CPU and memory usage and cause the browser and/or system to be unresponsive, which the extension will detect as it would differ significantly compared to the baseline values. Special attention is needed to avoid identifyng CPU and memory usage spikes on regular websites as a potential malicious activity.
DOM (Document Object Model)
Tracking objects in the DOM is a tricky subject as the pages on the web differ significantly and there are many ways to attack the user.
Defending against clickjacking attacks is described in the article A Solution for the Automated Detection of Clickjacking Attacks. The idea is to track iframes on the page and when the user clicks on something, detect if there are overlapping clickable elements in the location of the click, suggesting potentially malicious transparent element in the iframe, as shown on the image below:
 |
| Clickjacking attempt against Twitter |
Chrome extensions architecture
Extensions overview
A Chrome extension is a zipped bundle of HTML, CSS and Javascript files that add functionality to the browser. Extensions are basically web pages and as such, they can use the APIs that browsers provide to web pages, in addition to Chrome APIs made for use in extensions.
Many extensions have a background page, an invisible page that holds the main logic of the extension. An extension can also contain other pages that present the extensions UI. If the UI is needed, it can be presented as a browser action (shown on all pages) or page action (shown only on some pages, depending on a page). The following image shows the architecture of an extension with a browser action:
 |
| Browser action architecture |
The HTML pages inside an extension have complete access to each others DOMs, and they can invoke functions on each other. In the background page, we can use any of the chome.* APIs, but if we need to interact with the page currently loaded in the browser, to read and change the DOM, we need to use content scripts.
Content scripts
A content script is some JavaScript that executes in the context of a page thats been loaded into the browser. It behaves more like a part of the loaded page than a part of the extension. They can access and change the web pages the user visits, but cannot modify the DOM of its parent extension background page. This increases security as the malicious web page cannot use the extensions content script to attack the extension.
But the content scripts arent completely cut off from the extension. They can communicate with the extension by sending messages using the chrome.runtime.sendMessage API call. The architecture is shown here:
 |
| Content script architecture |
Its also important to note that content scripts are run in a special environment called an isolated world. They have access to the DOM of the page they are injected into, but not to any JavaScript variables or functions created by the page. Basically, the content script cant access the javascript code running on the page, and the same is in reverse - javascript code on the page cannot interfere with the content script. This is shown here:
 |
| Content script isolation |
While this protects our extension against malicious web pages, it also limits what we can do. To get around that, we can either set up event listeners which will intercept events on the loaded page, or inject a javascript script directly to the page. The latter method is insecure and shouldnt be used for communicating with the extension.
Extension proof of concept
This simple extension tracks the CPU usage of the browser and shows it to the user when the browser action button is clicked. Also, it has a configuration page where the user can configure how often will the data be saved and whether or not the saving is enabled.
The extension consists of:
- browser action - popup page that is shown the the extension button is clicked and dsplays the cpu usage to the user
- background page - it handles getting the CPU data from the chrome API and saves the data to localStorage
- options page - shows the configuration options to the user
On the next image, the popup and options page are shown:
The next step is adding new functionality to the extension such as adding a content script to track DOM data and adding more configuration parameters to the options page.
Heres the link to my Github repository containing the work-in-progress extension: IPS Extension
Heres the link to my Github repository containing the work-in-progress extension: IPS Extension
download file now
Saturday, September 23, 2017
Top 10 melhores jogos de browser jogos para jogar no Navegador
Top 10 melhores jogos de browser jogos para jogar no Navegador
Acho que todo mundo sabe o que s�o jogos browser certo? N�o? Jogos browser s�o basicamente jogos para se jogar em navegadores sem precisar fazer download, tamb�m s�o definidos por muitos como "jogos para se jogar no trabalho", mas isso n�o vem ao caso agora.
Essa onda de games para navegadores est� chegando com tudo desde 2009. Alguns dos jogos mais recentes impressionam principalmente pelo gr�fico. Isso me motivou a montar essa lista dos 10 melhores jogos browsers onlineexistentes hoje.
Tribal Wars - Estrat�gia Medieval
Editora: InnoGames
Tribal Wars � um jogo online baseado na idade m�dia. Cada jogador � l�der de uma pequena aldeia, na qual deve evoluir pegando recursos, treinando guerreiros e atacando outras aldeias, assim ganhando pontos, poder e gl�ria.
CLIQUE AQUI PARA JOGAR TRIBAL WARS
Drakensang Online - MMORPG Medieval N�rdico
Editora: Bigpoint
Drakensang Online � o primeiro jogo de Browser da saga Drakensang. Voc� pode ser um Mago, um Guerreiro ou um Arqueiro, o n�vel m�ximo � 40 e a cada n�vel 5 n�veis voc� aprende uma habilidade nova. Drakensang Online � composto por 5 servidores sendo 3 europeus 1 norte americano e 1 sul americano, ent�o voc� pode jogar com pessoal de todo o mundo.
Pra mim o Drakensang Online � o melhor jogo da lista principalmente pelo quesito gr�fico e jogabilidade (que � do estilo Diablo)
CLIQUE AQUI PARA JOGAR DRAKENSANG ONLINE
TRAVIAN - Estrat�gia Medieval
Editora: Travian Games
TRAVIAN � um jogo baseado na idade m�dia e tem quase o mesmo conceito que o Tribal Wars. Construir e Aumentar o seu imp�rio, organizar ex�rcitos para atacar os inimigos e ganhar pontos para crescer cada vez mais. A diferen�a � que TRAVIAN � um jogo digamos que mais complexo, tem mais op��es de jogabilidade.
CLIQUE AQUI PARA JOGAR TRAVIAN
RuneScape - MMORPG
RuneScape se passa em um universo fict�cio chamado Guilenor, que � dividido em v�rios reinos, regi�es, cidades e vilar. Os jogadores podem se deslocar por Guilenor a p�, se utilizando feiti�os de teletransporte, bal�es, navios e outros. os jogadores s�o representados por avatares customiz�veis, cujas metas e objetivos s�o definidos pelos pr�prios jogadores. Eles podem lutar contra monstros e at� contra outros jogadores (pvp), ao passar de n�vel o jogador ganha pontos de experiencia, nas quais podem trocar por skills. Os jogadores podem interagir entre si atrav�s de conversas, trocas de itens, ou participando em mini jogos.
CLIQUE AQUI PARA JOGAR RUNESCAPE
Grepolis - Estrat�gia Greco Romana
Editora: InnoGames
Em Grepolis o seu objetivo � evoluir uma pequena Polis (nome grego para cidade) para uma grande metr�pole, estabelecer um poderoso ex�rcito (tanto terrestre quanto naval) e conquistar pequenas ilhas. Durante o jogo voc� deve tamb�m tratar bem os deuses da Mitologia grega: Zeus, Hera, Athena e Poseidon.
CLIQUE AQUI PARA JOGAR GREPOLIS
The West - Estrat�gia do Velho Oeste
Editora: InnoGames
The West � um jogo de estrat�gia que se passa no Velho Oeste, o seu principal objetivo � dominar e expandir cidades, explorar as terras selvagens do deserto do velho oeste, e criar atiradores para os famosos duelos entre cidades.
Zoomumba - Jogo CasualEditora: InnoGames
CLIQUE AQUI PARA JOGAR THE WEST
Editora: Bigpoint
Zoomumba � um jogo casual onde o jogador tem que administrar um zool�gico, para evoluir o zool�gico � preciso simplesmente cuidar dos animais em 4 fun��es (alimentar, dar �gua, brincar, e dar banho) fazendo isso se ganha pontos experi�ncia para subir de n�vel, cada n�vel alcan�ado libera um animal diferente para colocar no seu zool�gico. � um jogo muito divertido pra quem n�o tem pressa de evoluir.
CLIQUE AQUI PARA JOGAR ZOOMUMBA
BeGone - FPS
Editora: NPlay
BeGone � um FPS parecido com Counter Strike, mas com gr�ficos at� melhores, sim, apesar de ser Browser, os gr�ficos s�o incr�veis. Em BeGoneexistem dois times: SWAT (policia) e a Militia (terroristas).
Editora: OASGAMES
Legend Online foi o MMORPG browser mais popular de 2012. Com tema medieval n�rdico m�gico, possui gr�ficos incr�veis e uma jogabilidade de combate emocionante, hist�ria envolvente, v�rios mapas, labirintos, pvps, e v�rios chef�es. Na minha opini�o n�o � melhor que Drakensang Onlinesimplesmente por ter uma jogabilidade meio estranha, mas mesmo assim � um jogo fant�stico.
Editora: NPlay
BeGone � um FPS parecido com Counter Strike, mas com gr�ficos at� melhores, sim, apesar de ser Browser, os gr�ficos s�o incr�veis. Em BeGoneexistem dois times: SWAT (policia) e a Militia (terroristas).
CLIQUE AQUI PARA JOGAR BEGONE
Legend Online - MMORPG Medieval N�rdico
Editora: OASGAMES
Legend Online foi o MMORPG browser mais popular de 2012. Com tema medieval n�rdico m�gico, possui gr�ficos incr�veis e uma jogabilidade de combate emocionante, hist�ria envolvente, v�rios mapas, labirintos, pvps, e v�rios chef�es. Na minha opini�o n�o � melhor que Drakensang Onlinesimplesmente por ter uma jogabilidade meio estranha, mas mesmo assim � um jogo fant�stico.
CLIQUE AQUI PARA JOGAR LEGEND ONLINE
Pirate Storm - Estrat�gia Naval
Editora: Bigpoint
Pirate Storm � um jogo online totalmente gratuito para colocar voc� no controle de uma tripula��o pirata.
Neste jogo de estrat�gia, voc� pode controlar um navio, combater embarca��es inimigas, derrotar poderosas criaturas mar�timas, roubar tesouros e evoluir a ponto de enfrentar in�meros advers�rios com um �nico barco.
CLIQUE AQUI PARA JOGAR PIRATE STORM
O que acharam da lista? j� jogaram algum desses jogos? qual jogo voc�s adicionariam a lista?
Comentem!
download file now
Friday, September 22, 2017
Google Chrome Browser Apk For Android Download Latest
Google Chrome Browser Apk For Android Download Latest
Google Chrome Browser For android description
With google chrome browser you can Browse fast on your Android phone and tablet with the Google Chrome browser you love on desktop. Pick up where you left off on your other devices with tab sync, search by voice, and save up to 50% of data usage while browsing. 
� Sync Across Devices - seamlessly access and open tabs and bookmarks from your laptop, phone or tablet
� Save Data - reduce mobile data usage by up to 50% while browsing
� Faster Browsing - choose from search results that instantly appear as you type and quickly access previously visited pages
� Voice Search - use the magic of Google voice search to find answers on-the-go without typing
� Translate - easily read webpages in any language
� Intuitive Gestures - open as many tabs as your heart desires and quickly flip through them by swiping from side to side on the toolbar
� Privacy - use Incognito mode to browse without saving your history
Google chrome browser apk for android Download Details [Latest]
��? Download version : 55.0.2883.91
��? Apk Download Size : 61.4Mb
��? Google chrome browser apk download link : Download Google chrome apk v55.0.2883.91 here
Whats new in latest Google chrome apk for android
New in Chrome 55.0.2883.91
� You can Easily download music, videos, and even full web pages for viewing offline
� You Can View and share your downloads within Chrome
� You can See misspelled words highlighted in text fields
� Improvements to contextual search UI
� Bug fixes and significant memory savings
� You Can View and share your downloads within Chrome
� You can See misspelled words highlighted in text fields
� Improvements to contextual search UI
� Bug fixes and significant memory savings
download file now
Wednesday, September 20, 2017
Download Tor Browser For Windows Go Underground
Download Tor Browser For Windows Go Underground
Developer: Tor Browser Bundle Developed by - The Tor Project, Inc.
Features Of This Software:
Browse any Block Website
Browse with Anonymous Proxy
Fast Browsing with New Version
Torrent Sites Supported
Browse any Blocked Torrent Sites
adf,ly Link Supported
Whats New in Version 6.0.3:
# All Platforms
* Update Firefox to 45.3.0esr.
* Update Torbutton to 1.9.5.6.
- Disable asmjs for now.
- Use proper parent window for plugin prompt.
* Update HTTPS-Everywhere to 5.2.1.
* Update NoScript to 2.9.0.12.
* Disable the meek-google pluggable transport option.
* Remove mercurius4 obfs4 bridge.
* Fix regression test for keyboard layout fingerprinting.
* Tor Browser is crashing in graphics code.
* Favicon requests can bypass New Identity.
# OS X
- Icon doesnt appear in Applications folder or Dock.
# Android
- Avoid compilation error when MOZ_UPDATER is not defined.
Download Tor Browser Offline Setup From Bellow:
Download File
File size: 47 MB
Requirements: Windows (All Versions)
Languages: Multiple languages
License: Freeware
Date Released: August 3, 2016
Author: The Tor Project, Inc.
download file now
Subscribe to:
Posts (Atom)