This could be very bad... In a news.com article published Friday, a couple of security companies (it's the good guys this time, at least - but they are planning to present it at Black Hat this week...) discuss how they've discovered a way to use your web browser and its built-in JavaScript engine to access information and resources inside the network where the browser resides and send it off to someone else or to launch attacks that appear to come from inside the network. This may be the next big wave of attacks.

SPI Dynamics is one of the companies mentioned in the article. They're discussing the results of their research at the Black Hat event this week, but they have also posted the article and a sample ("proof of concept" as they say) web page that does some of what they've discovered for all to see, use... and copy for that matter.

SPI Dynamics, by the way, has a quality set of expert articles, white papers, webcasts, and more on their web site.

Not sure how I feel about publishing this kind of stuff, but in the real world the bad guys will figure it out quickly enough anyhow, and I imagine they already have. The key to keeping this from becoming a major security event will be making sure cross-site scripting attacks cannot happen on web servers and using protective systems that catch malicious script on client machines before it gets run. Ultimately, JavaScript really needs to be revisited, but to do that probably means changing the way web sites work and coming up with a whole new standard.

JavaScript opens doors to browser-based attacks By Joris Evers
http://news.com.com/2100-7349_3-6099891.html

Malicious JavaScript embedded in a Web site can let a miscreant map a home or corporate network and attack connected devices ...

... "We have discovered a technique to scan a network, fingerprint all the Web-enabled devices found and send attacks or commands to those devices," said Billy Hoffman, lead engineer at Web security specialist SPI Dynamics. "This technique can scan networks protected behind firewalls such as corporate networks" ...

... Both SPI Dynamics and WhiteHat Security came up with the JavaScript-based network scanner at about the same time, he said. The companies plan to talk about their findings at next week's Black Hat security event in Las Vegas.