{"id":249629,"date":"2018-02-22T09:04:37","date_gmt":"2018-02-22T07:04:37","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=249629"},"modified":"2018-02-22T09:07:50","modified_gmt":"2018-02-22T07:07:50","slug":"a-keylogger-written-in-pure-css","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/249629-a-keylogger-written-in-pure-css.html","title":{"rendered":"A keylogger written in pure CSS"},"content":{"rendered":"

Developer Max Chehab has released a proof-of-concept attack that uses the built-in CSS support of a browser to log keystrokes in a password field.<\/p>\n

Chehab’s attack consists of a Chrome Extension which captures passwords and sends them to a server the hacker controls. The code is on GitHub<\/a><\/strong>.<\/p>\n

“This attack is really simple. Utilising CSS attribute selectors, one can request resources from an external server under the premise of loading a background image,” said Chehab.<\/p>\n

To verify his concept, Chehab provided the following instructions:<\/p>\n

    \n
  1. Open a website that uses a controlled component framework such as React.<\/li>\n
  2. Press the extension C on the top right of any webpage.<\/li>\n
  3. Type your password.<\/li>\n
  4. Your password should be captured by the express server.<\/li>\n<\/ol>\n

    Now read:\u00a0Keylogger found in HP laptop drivers<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

    The proof-of-concept attack uses the built-in CSS support of a browser.<\/p>\n","protected":false},"author":23,"featured_media":187161,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27],"tags":[43128,49051],"class_list":["post-249629","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-keylogger","tag-max-chehab"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/249629"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=249629"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/249629\/revisions"}],"predecessor-version":[{"id":249699,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/249629\/revisions\/249699"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/187161"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=249629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=249629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=249629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}