[42630] in Cypherpunks
Re: Please send cash
daemon@ATHENA.MIT.EDU (Dr. Frederick B. Cohen)
Tue Oct 31 21:36:44 1995
From: fc@all.net (Dr. Frederick B. Cohen)
To: hallam@w3.org
Date: Tue, 31 Oct 1995 21:26:35 -0500 (EST)
Cc: cypherpunks@toad.com
In-Reply-To: <9511010212.AA30561@zorch.w3.org> from "hallam@w3.org" at Oct 31, 95 09:12:55 pm
> > While HotJava prevents applets from actively opening connections that
> > violate the user-selected security policy, it allows an applet to accept
> > connections from anywhere. At this point, an applet only has to use any one
> > of a number of channels to communicate where it is, and have the remote end
> > do the active open.
>
> What if I start a Java applet then send it a faked TCP/IP packet from another
> host? Can I hotwire an outgoing connection that appears to be from the victim
> host?
I think so.
--
-> See: Info-Sec Heaven at URL http://all.net
Management Analytics - 216-686-0090 - PO Box 1480, Hudson, OH 44236
