Javascript Malware Targets Intranets

deary65

QUOTE
There's a chilling mode of attack quietly emerging that forces an unsuspecting browser into hacking into the user's own corporate intranet. From there, the attacker can scan the network, reconfigure network devices such as routers and firewalls, or even break into corporate payroll systems.

Attackers already use this JavaScript-based malware via cross-site scripting (XSS) to attack public Websites. But Jeremiah Grossman...will demonstrate at next week's Black Hat conference...how this method can just as easily hack into a corporate intranet...Grossman will show how intranets...are prime targets for these JavaScript-based attacks that use XSS to exploit weaknesses in an organization's Web applications and take control of its internal network devices.
http://www.darkreading.com/document.asp?doc_id=99686&WT.svl=news1_2