Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security The Internet

DEF CON Hackers Unveil a New Way of Visualizing Web Vulnerabilities 57

Posted by timothy from the follow-the-bouncing-ball dept.
punk2176 writes "Hacker and security researcher Alejandro Caceres (developer of the PunkSPIDER project) and 3D UI developer Teal Rogers unveiled a new free and open source tool at DEF CON 21 that could change the way that users view the web and its vulnerabilities. The project is a visualization system that combines the principles of offensive security, 3D data visualization, and 'big data' to allow users to understand the complex interconnections between websites. Using a highly distributed HBase back-end and a Hadoop-based vulnerability scanner and web crawler the project is meant to improve the average user's understanding of the unseen and potentially vulnerable underbelly of web applications that they own or use. The makers are calling this new method of visualization web 3.0. A free demo can be found here, where users can play with and navigate an early version of the tool via a web interface. More details can be found here and interested users can opt-in to the mailing list and eventually the closed beta here."
This discussion has been archived. No new comments can be posted.

DEF CON Hackers Unveil a New Way of Visualizing Web Vulnerabilities More

DEF CON Hackers Unveil a New Way of Visualizing Web Vulnerabilities

Comments Filter:

  • The front end is nifty but I'm not fond of buzzy names. I don't really need a pretty pretty GUI. I'm more interested in the back end. It'd be nice if there was a link or more info about it.

    • Ask and you shall receive :-). I have more information on that than you'd probably like to know. The back-end is actually quite similar to the PunkSPIDER project's back-end and uses all of the same principles, most of the same open software as its base, and even reuses some of the code (in fact, once it's done I'll probably make the back-end of web 3.0 a part of PunkSPIDER 2.0 - free and open source of course). So with that said here's info on how PunkSPIDER was built, which should give you a solid start to

      • Very nice. It sounds like you could use it to create a dynamic high risk list that could be added to content filter or intrusion protection device. I'm going to have to take a closer look now. I'll try parsing the data into rules for the IPS. If the database is too large, which I suspect it is, I'll have to find a spamhaus style way of implementing it.

  • "Unity web player"? (Score:5, Informative)

    by mysidia ( 191772 ) on Saturday August 10, 2013 @05:26PM (#44532951)

    When I visit the demo site it prompts me to install some software I never heard of, before showing the demo.

    Seriously.... they make a malware visualization demo requiring me install some browser malware in order to view it?

    • Re: (Score:1)

      by jdharm ( 1667825 )
      I stopped there. I just know when I install that software the first thing I will see is not some pretty graphic showing the complex relationship between websites but a simple statement in flashing letters:

      And that is why malware propagates. Idiot.
    • Erm. Unity is a well-known 3D gaming engine, dude.... http://unity3d.com/ [unity3d.com]

      • Re: (Score:2)

        by mysidia ( 191772 )

        Erm. Unity is a well-known 3D gaming engine, dude....

        Could of fooled me. As far as I know, Unity is a very expensive product from Cisco for providing voicemail integrated with Microsoft Outlook and Exchange.

        So apparently there is some niche product that is a 3D engine of some sort, and I get that. But the publisher should still not be doing something that requires me to install software, to view it.

        If they're posting it online, they should use a standard format such as HTML5.

        • Erm. Unity is a well-known 3D gaming engine, dude....

          Could of fooled me. As far as I know, Unity is a very expensive product from Cisco for providing voicemail integrated with Microsoft Outlook and Exchange.

          So apparently there is some niche product that is a 3D engine of some sort, and I get that.
          But the publisher should still not be doing something that requires me to install software, to view it.

          If they're posting it online, they should use a standard format such as HTML5.

          Nah Unity is the value subtracted interface to Gnome in the latest versions of Ubuntu

        • Re: (Score:2)

          by gl4ss ( 559668 )

          well, what they did was make a desktop software with available tools that has a web loader...

          and publish it as a "web software" when it's just desktop sw with a launcher in all practicality. but since everything has to be web nowadays, then web it is.

        • Re: (Score:2)

          by jon3k ( 691256 )
          Don't worry there's Unity Connect now, runs on Linux.

      • Re: (Score:1)

        by Anonymous Coward

        Erm. Unity is a well-known 3D gaming engine, dude.... http://unity3d.com/ [unity3d.com]

        Sorry, but your statement here doesn't diminish the huge cloud of irony hanging over this. User must install plugin to see visualization about malware fed often via plugins. Uhhh, yeah...reminds me of that time I was taking a security course teaching about how to never click on pop-up windows...when the course was initiated via, you guessed it, a pop-up window.

    • Re: (Score:3, Informative)

      by ThatAblaze ( 1723456 )
      A little research indicates that Unity is a 3D engine. It's used a lot for 3D games. http://unity3d.com/unity/ [unity3d.com]

      • Re: (Score:1)

        by znrt ( 2424692 )

        A little research indicates that Unity is a 3D engine. It's used a lot for 3D games. http://unity3d.com/unity/ [unity3d.com]

        pretty overwhelming records show that third party browser plugins are a major source of vulnerabilities, even more so if they are closed source and maintenance restricted to private profit organizations whose due dilligence in the process simply cannot be assumed, or even have shown outright negligence. see sun, oracle, adobe, apple, microsoft ...

        this is not just ironic, it must be april fool's day in some random geeky tz somewhere.

        • You make a good point, no one should ever use any non-open source browser plugins for anything. Down with shockwave! Down with flash! Down with iTunes! Down with Google Docs! It's time to go back to the dark ages because no one's source can be assumed to be secure unless you have the option to read it! Not that you would actually bother to go read it, any more than you would bother to go vote.. but that option simply must be there!

          • Re: (Score:2)

            by mysidia ( 191772 )

            You make a good point, no one should ever use any non-open source browser plugins for anything. Down with shockwave! Down with flash! Down with iTunes! Down with Google Docs!

            I don't know about the last 2, but if you avoid the first two, then you have provided yourself some significant protection from malware which often exploits vulnerabilities in Flash, Shockwave, Adobe Abrocat reader plugin, Java plugin,.

            HTML5 with Javascript and WebGL is not the dark ages

            • I don't know about the last 2, but if you avoid the first two, then you have provided yourself some significant protection from malware which often exploits vulnerabilities in Flash, Shockwave, Adobe Abrocat reader plugin, Java plugin,.

              HTML5 with Javascript and WebGL is not the dark ages

              So you're saying you should avoid plugins with a track record of being exploited and go ahead and use plugins from an established company that don't have such a track record? That's excellent advice.

              I hate to break it to you but Unity falls into the latter category, not the former.

          • Re: (Score:1)

            by znrt ( 2424692 )

            i actually love this idea def-con puts out. as a former cyberpunk fan i started a proof of concept of "the matrix" myself, decades ago. didn't finish, of course. if i did it today i even might as well choose unity3d too (probably not, but it wouldn't be unreasonable). but what i certainly would not do is claim to be "educating people about dealing with vulnerabilities" while just shoving another major source of them in right their pants. epic fail.

            we definitely need a fresh perspective on the way we interac

        • Re: (Score:2)

          by Yvanhoe ( 564877 )
          Actually, the unity plugin is now pre-installed in chrome under windows. I fear it will quickly become the new flash runtime.

          I would not call it a malware, I do think that Google did a good job to clean it up, and that the Unity company really does need to stay clear of malware, given their business model, but I really despise the idea that we will have to indulge for yet another binary blob.
  • cool! just like in that 1995 movie "Hackers" ! http://www.youtube.com/watch?v=PZHG3pi9EDA [youtube.com]
  • Most sites I type in don't work, but I found something interesting by typing in bushofficial.com

  • For some reason, I didn't think defcon would be receptive to guys shilling their new commercial products.

  • Are there screenshots of the thing anywhere, for the one that cannot or do not want to install that Unity player?

  • I mean seriously, you can't even edit the goddam URL field; hovering over nodes makes them glow (wooo) but clicking does nothing. Maybe it's an issue with the Unity plugin (yeah, Unity! seriously. FFS)

    File this under "utter shite"

    • Double clicking and dragging work.

      • Re: (Score:3)

        by davesag ( 140186 )

        Be that as it may, it's profoundly useless if you can't edit the root URL however.

        Also, given the UI swiftly becomes a morass of swirling links, pinning one down to doubly click on it is next to impossible. The back end of this might be great but the UI is total shit.

  • Irrespective of all the "installing a plugin to determine secuity status" comments I've read so far , ...

    I'd just like to say that a strip window in the bottom of my browser that spits a running commentary (a la XConsole)of what the browser's doing in the background and who it's talking to, would be cool. I want what it spits out to be user selectable and configurable. Get on it. You know you want to.

Slashdot Top Deals

"To take a significant step forward, you must make a series of finite improvements." -- Donald J. Atwood, General Motors

Close