"Jikto" - potential new threat?

Computer Help and Discussions Windows Security
1
Jikto is different in that way from bots, a common method miscreants use to take control over PCs. Typically, bots compromise PCs through security holes in Web browsers or e-mail messages laden with a Trojan horse. Somebody with a patched browser, smart e-mail habits and updated security software would typically be protected against bot software.

"As a user you really can't do much against Jikto or other JavaScript-based threats," Hoffman said. "I am not giving you a Trojan or a traditional backdoor. I am not really compromising your computer. That is what makes this so scary. Antivirus is not going to help you."

Full Article from CNet

Although for now there isn't "real" damage from Jikto, that will surely change soon. One more reason to use the No-Script extension for firefox.

---

2
As expected, SPI Dynamics researcher Billy Hoffman demonstrated a Web application vulnerability scanner written in JavaScript. The tool, called Jikto, can make an unsuspecting Web user's PC silently crawl and audit public Web sites, and send the results to a third party, Hoffman said.

But, in a change of plans, Hoffman did not publicly release Jikto. "The higher-ups first say we can, and then they change their mind," he said after his presentation. "We decided to focus on the educational message and show people the danger."

Another SPI Dynamics representative at ShmooCon said the company had decided not to release Jikto because that could play into the hands of cybercrooks. "We do not want to release anything that could be used for malicious purposes," said Michael Sutton, a security evangelist for the company, which sells Web security tools.

ShmooCon attendees asked Hoffman for the Jikto code, expecting it to be released at the event. But there didn't appear to be great disappointment when he said SPI Dynamics was not releasing the tool.

"Once one person has talked about the ability to do it, it doesn't take that long for somebody else to come up with it," said one ShmooCon attendee who asked to remain anonymous. "It will come out."

Follow Up on Cnet