Netflix Launches Open Source Tool Against Cross-Site Scripting

Video streaming service Netflix has a opensource tool launched that allows web applications on their cross-site scripting can test. Cross-site scripting (XSS) is a problem that places an attacker to run code on a website which is then executed in the browser of visitors.

In this way, an attacker can steal cookies, for example, and thus gain access to the account of a user. Although XSS already been known for years, it is since 2004 in the OWASP Top 10 most common security problems. According to recent research would be almost half of web applications contain one or more XSS vulnerabilities.

There are already several tools available to detect XSS problems, just as Netflix cover that not everything within an application or multiple applications for which a security engineer is responsible. For example, the tools do not test for XSS in secondary applications. As a solution, Netflix decided to develop in their own words more complete framework for testing for XSS, which should make it easier to identify XSS, so to overcome the problem quickly.

The result is "Sleepy Puppy", as the tool is called. Through the framework can security engineers the process of finding, managing and tracking XSS over longer periods and simplify multiple assessments. Netflix, the tool also open source created. The video streaming service says Sleepy Puppy also be used for finding XSS and wonders how the open source community, the tool will use. According to Daniel Miessler HP and OWASP, who was already a demonstration in July, Sleepy Puppy is a promising tool.

1900 Roku Media Streamers Accessible Via The Internet

Around 1,900 Roku media streamers are publicly available on the Internet, while this probably is not the intention of the owners. The Roku is actually a small computer for streaming media such as music and movies to a television and especially in the US very popular .

The device features an API (application programming interface) to be controlled via a smartphone. This is to not use any form of authentication. The idea behind the API is that it is applied locally use only and can not be accessed over the internet.Recently discovered a researcher to incorrectly set Roku media streamers are indeed accessible via the internet and that anyone who can give commands via the API.

John Matherly search engine Shodan therefore decided to scan the Internet, the number of Roku media streamers which is accessible via the web. His scan yielded some 1,900 devices. Matherly according to the number, however, differ depending on the time zone that the scan is performed. Using the scan was also discovered which several Roku media streamers are using it, which versions are installed, Netflix is the most popular channel and that many users do not update the apps and channels on their device.

EFF Also Not Happy With YouTube Without Flash Player

In late January announced that Google's now standard HTML5 for video playback, so users do not have Adobe Flash Player need more, but according to the American civil rights movement EFF this is not a victory or improvement for Internet users.

The Electronic Frontier Foundation (EFF) is also not in favor of Adobe Flash Player, which it describes as a closed technology where regular vulnerabilities are found in exposing millions of users to attack. Switching to HTML5 seems at first sight, therefore an improvement, but it is anything but that, late science fiction writer, journalist and blogger Cory Doctorow know.

The problem is that to play Youtube videos without Flash Player Encrypted Media Extension (EME) is used. According Doctorow a controversial technology that Apple, Microsoft and Google, after consultation with Netflix agreed upon. In the spring of 2013 decided the World Wide Web Consortium (W3C) is behind to rally the extension. Last May, Mozilla joined here. According to the browser developer would be no support for Netflix users lose other browser vendors. To the annoyance of Doctorow, who likens it to "destroy the village to save it."

In the case of YouTube is it now means that users without Adobe Flash Player to view videos. "As long as your browser supports the W3C version of Adobe's proprietary software," says Doctorow. Firefox Users can view all the Youtube videos without Flash, but will in some cases require standardized by W3C Encrypted Media Extension. But who uses proprietary software from Adobe, including Mozilla announced last year. According Doctorow is therefore ultimately nothing changed.