Slashdot Log In
McAfee Sites Vulnerable To XSS Attack
Posted by
kdawson
on Tue May 05, 2009 03:31 AM
from the unguarded-guardians dept.
from the unguarded-guardians dept.
An anonymous reader notes that this weekend, ReadWriteWeb discovered a security hole on several McAfee sites, which lets any attacker piggyback on the company's reputation and brand in order to distribute malware, Trojans, or anything else. The submitter adds an ironic coda to McAfee's epic fail: "In the 'how to HTML Injection' section, the author provided the four steps needed to execute a simple, no-brainer injection, but unfortunately, exposed a hole in NY Times website when they republished the article. While the author changed the offending text to an image, the Times is still using the original story which redirects directly to ReadWriteWeb [via XSS]." From the RWW post: "During tests this weekend, we discovered the company who claims to 'keep you safe from identity theft, credit card fraud...' has several cross-site scripting vulnerabilities and provides the bad guys with a brilliant — albeit ironic — launching pad from which to unleash their attacks."
Related Stories
Submission: McAfee sites vulnerable to XSS attack by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Epic fail (Score:2, Funny)
Horribly.
Re:Antivirus on Windows (Score:5, Interesting)
It's a web page exploit, wtf does it have to do with Windows ?
Redirects work in all browsers, and while I can't speak for Firefox, at least MSIE 8 will warn you of a possible cross domain phishing attempt.
McAfee also make products for Linux and Apple you know.
Just another anti-ms troll who can't wait to make his mark on /.
Winslows is teh suxxors !!!
Parent
Re:Antivirus on Windows (Score:4, Insightful)
Parent
Great idea. (Score:2, Insightful)
Firefox + noscript will block XSS attempts.
Yes. We know.
Firefox + NoScript will block [INSERT WEBSPLOIT HERE].
NoScript also kinda prevents nearly everything on the web from working as intended, and is not a solution. Please shut up about how much you think it rocks.
Re: (Score:2)
You can whitelist mcafee scripts.
Re: (Score:2)
NoScript also kinda prevents nearly everything on the web from working as intended, and is not a solution. Please shut up about how much you think it rocks.
You just aren't using it correctly.
Re: (Score:2)
Not for XSS, which only applies to "untrusted attacks trusted", and doesn't work if there are no "untrusted".
Re: (Score:2)
Redirects work in all browsers, and while I can't speak for Firefox, at least MSIE 8 will warn you of a possible cross domain phishing attempt.
Firefox + noscript will block XSS attempts.
It will also conveniently unblock advertisements, overriding adblock plus in order to let you see that advertising content that the developers feel you should see. So much for smug superiority...
Re: (Score:2)
Important update for Adblock Plus users: Version 1.9.2.6 automatically and permanently removes the cotroversial NoScript Development Support Filterset deployed with NoScript 1.9.2.4. I sincerely apologize with ABP users. Even though information about its presence and how to remove it in two clicks was given on the AMO install page, on this site's install page, on the release notes landing page and in the FAQ, not including a prompt asking for explicit permission beforehand from the start has been a very bad omission, and I want all the ABP users who felt betrayed to know how much I'm sorry for that. As a sign of good will and repent, current NoScript 1.9.2.6 completely removes the ABP filterset on startup with no questions asked. Thanks for your patience.
-- Giorgio
Update: More apologies and background facts on author's blog Hackademix.net. [hackademix.net]
Re: (Score:2)
Re: (Score:3, Informative)
A much more serious issue- in the control panel for their web application scanning service was published yesterday.
http://skeptikal.org/2009/05/epic-failure-from-mcafee.html [skeptikal.org]
This XSS is cool, but it's not news. I've been documenting McAfee web vulnerabilities for a year now. Rest assured, there are many more, some of which will be published later this week.
Hmm. (Score:3, Interesting)
Yikes. I wonder if any of my code has that vulnerability. I don't think so. I try to make sure I run all user-submitted text through something to escape those kinds of characters before sending it back to the browser as HTML, but it's possible I could have missed something somewhere. The only time I don't do this is if the user-submitted input is first passed through an input validator that should reject anything containing dangerous characters (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address). But how can I be sure I haven't missed anything somewhere?
The only way I could be sure is if I did a thorough audit of all my web site code, and I really don't want to go through that hassle. It's probably fine. I've never had an XSS attack used successfully against any site I've built. Certainly not one that was using SSL. So let's just assume that this trend will continue!
Right?
Re:Hmm. (Score:4, Insightful)
The only time I don't do this is if the user-submitted input is first passed through an input validator that should reject anything containing dangerous characters (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address). But how can I be sure I haven't missed anything somewhere?
Ouch. I can disable the client-side validation entirely. I can also write my own form and send you anything I like.
Sanitize everything.
Parent
Re: (Score:2)
Re: (Score:2)
User submitted implies that he's talking about server side validation of the received POSTed data. Also he specifies that he is properly escaping dangerous characters before sending the response BACK to the browser.
No where could it be interpreted as client-side validation.
Re: (Score:2)
User submitted implies that he's talking about server side validation of the received POSTed data. Also he specifies that he is properly escaping dangerous characters before sending the response BACK to the browser.
Yes, this is precisely what I meant.
I normally implement server-side input validation first, test it, then add client-side input validation in JavaScript.
On the server side, once it's been through input validation, then anything that needs to be sent back to the browser is escaped (run through a function that converts characters like greater-than/less-than symbols to HTML entities, etc.), but I often skip this for data that is known to be safe because it would have failed input validation if it wasn't (e.g.
Re: (Score:2)
OP means he copies the offending URL to the clipboard, mungs it, and THEN pastes it to the location bar (URL bar ("awesome bar" in firefox)). JS is not involved at all.
Re: (Score:2)
User-submitted doesn't imply client-side (javascript) validation. I always sanitize user-submitted content via PHP. Of course, replace PHP with Ruby, ASP, Java or whatever other server-side language you're using. It's pretty hard for a user to manipulate server-side code without a login shell to the webserver or a really brain-dead server setup.
Re: (Score:3, Insightful)
Yes I'm a lazy coder I know, but fuck it, you get what you pay for.
Re:Hmm. (Score:5, Insightful)
Do it right, or don't do it at all.
I'm all for cutting corners when dealing with stingy clients (which tend not to be clients for long) so I get your way of thinking, but basic security shouldn't be one of the corners to cut. In the end it will be worthwhile to simply add a bit of code to sanitize user input to avoid all the hassle you'll get in the long run.
If you are spending an hour (of your own or billed) every two months for cleaning up crap, next time please spend two hours and add some validation. Keep on billing said client for spam cleanups for all I care.
Every time a viewer sees spam it makes your work seem poor. Even a lazy coder knows when it will cost him more work in the long run.
Parent
Re: (Score:2)
Re:Hmm. (Score:4, Interesting)
If I'm outputting to web, I then always validate / encode *all* content, usually using something like the Microsoft AntiXSS library. This stops user-inputted markup from being rendered, but it also stops markup that's been maliciously inserted into your database from being remembered. Remember the SQL injection attack that appended a javascript snippet to every field it could find? It was looking to do an XSS attack.
If you need to chuck out user-generated markup, make sure you contstruct your whitelist and ruleset very carefully.
Parent
Re: (Score:2)
I find it easiest to not validate anything on input, because I don't know what my output is necessarily going to be - could be HTML, could be PDF (for example). If I am outputting to non-HTML I don't want to wade through HTML-encoded soup to get something sensible back out.
What I mean by input validation is aborting with an error if the user has submitted invalid data, e.g. entering "foo" in an e-mail address field. Nothing is encoded or escaped at this point. If I need to store it in a database, the data is stored as-is, using the Perl DBI's automatic escaping feature to make sure SQL injection attacks aren't possible (I can think of one occasion [phroggy.com] when this wasn't adequate and I had to wring my own routine). Whatever else I need to do with the data, any necessary escaping
Re: (Score:2)
Re:Hmm. (Score:5, Informative)
Parent
Re: (Score:2)
> (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address)
Don't be so sure about that...
Especially not when a valid email CAN have a lot of funky things in it, even comments.
Hmm. It looks like you're right. On sites where I've written my own validation code it won't be accepted, but where I've used a CPAN module, it might be. I'll have to see if that's a problem anywhere.
Normally characters like greater-than/less-than symbols are not permitted, but the local-part (left of the @ symbol) can be quoted, and if it's quoted, it can contain them. Spaces are also allowed. So, "<script>alert('foo');//</script>"@example.com is technically a valid address. That's distur
Eat their own dog food (Score:3, Insightful)
Either they don't use McAfee secure ( http://www.mcafeesecure.com/us/ [mcafeesecure.com] Probably the right website, who knows really ), or their own dog food is garbage.
Either way it is bad gaffe. XSS is pretty well known in security circles. And this mistake is a relatively simple one (output validation or output filtering? please. After you read the linked article, you'll be even more sad they didn't catch this.
Syndicated version on NYT site (Score:5, Informative)
http://www.nytimes.com/external/readwriteweb/2009/05/04/04readwriteweb-mcafee-enabling-malware-distribution-and-fr-12208.html
executes the code and redirects to readwriteweb.com
Distribute? (Score:2, Insightful)
Re:Distribute? (Score:5, Informative)
Well, it injects code that can change the download link to a trojan that wraps the original thing. In your webbrowser.
In sites with logins and other user-private data, well, let me take Slashdot as an example. /., and the frameset would survive. You could even keep that tab open all day long, effectively making you a zombie host.
Imagine someone got some evil code into the site, that your browser would load and execute.
That code could quickly put the entire page into a frameset, with the outside being the control channel.
Then, while you were reading, it would load your unprotected profile in the background, and change your sig to that same evil code (or a link to it). So everybody else would get it too.
Then it would do a complete scan of your internal network, possibly detecting your router, and its ports. (All possible with JavaScript. Been there, seen it.)
You could click on a link in
In the process, it would accept arbitrary commands from the controlling system. If you happen to go on the site or your router, it could for example try things in there too, like set an external control IP to the controlling system, and gain full access to your own network. (Unlikely, but I've seen it happening.)
And all this is just the tip of the iceberg.
Parent
Re: (Score:2)
I think the parent's point is that the data submitted to McAfee's database and subsequently rendered back out on the following page is PERSONAL data belonging to you, and is unlikely to be seen by anyone else.
It's like making a purchase online ... at what point would anything you submitted (name, address, credit card number etc), be rendered back out for a third party to view ?
Notwithstanding it's a poorly designed website, the mitigation is that anything YOU submit is unlikely to cause a third party to fal
Not in my web browser (Score:2)
"In your webbrowser."
I think you meant "In your web browser as long as you're running Windows. If you're not running Windows you really don't need to care - just have a good laugh instead".
Re: (Score:2)
the XSS affects all browsers, that's the point. It can be easilly used as part of a phishing scam, where the only defence is a clued-up user. And Linux users *may* end up at Mcafee's site, if they're running this [mcafee.com] or this [mcafee.com]
Re: (Score:2)
XSS affecting all browsers is irrelevant if its main line of attack is a win32 trojan. Can't say I'm bothered about javascript malware , its a crippled language and will exit as soon as I close the tab anyway.
Re: (Score:2)
Then it would do a complete scan of your internal network, possibly detecting your router, and its ports. (All possible with JavaScript. Been there, seen it.)
I'd really like to see a source on that. In any reasonably current browser, you can't even read the local IP address with JavaScript [you can, if you use applets, but that's something quite different]. I highly doubt you could do anything like you describe with JS alone, unless the user happens to be running ancient software without security updates. In that case, he gets what he deserves.
CJ
Sure, but the camel was already broken... (Score:5, Interesting)
These days you can't fit the application and latest superdat onto a 128mb stick - and when I tell you that the application in only 20mb in size, you'll realise what a change this is. Their updates been spiralling out of control for two years. Now, some may argue that there's a lot more malware out there now, and I won't disagree. But I will say this: McAfee hasn't been getting significantly better as far as I can tell, and none of the other major players seem to have experienced this definitions file explosion, ergo McAfee is doing something wrong.
Furthermore, their version 8 enterprise has one of the worst failures I've ever seen for a virus scanner, which is hilariously related to the above. The application no longer knows how to handle its own virus defintions catalog: I'm not sure whether that's the sheer size, or the number of entries, but either way the update fails because of it. But get this: it says that the update has succeeded!
Can you imagine a more epic fail for a virus scanner than saying it's up to date, but being wrong? Neither could I, till I read the news today.
So long McAfee, I hope you enjoyed your time with the big players.
Re: (Score:3, Interesting)
Furthermore, their version 8 enterprise has one of the worst failures I've ever seen for a virus scanner, which is hilariously related to the above. The application no longer knows how to handle its own virus defintions catalog: I'm not sure whether that's the sheer size, or the number of entries, but either way the update fails because of it. But get this: it says that the update has succeeded!
They were just trying to catch up to Norton/Symantec Antivirus, which has had this feature since version 7 (I ran into it ENDLESSLY at Yuba College.) The fix was to reinstall windows (ever tried manually removing norton? heh heh) and run virus def updates manually. The problem remained at least until version 9, which is what they were running when I quit.
Re: (Score:2)
AVG was another one that jumped up pretty massively in file size. Perhaps not quite as fast though. If memory serves, version 6 was somewhere around the 5 megabyte size just a few years back. The latest, version 8, is a tad over 60 megabytes. I bet there is some cruft left over in those virus definitions. Probably more than a few marketing PHB's thinking that a huge file size must mean it's better.
Re: (Score:2)
Back in the day I had hilarious fun trying to use Norton's (I think) tool for making a bootable virus scan disk.
It put the bootable OS and virus scanner on one floppy, and the virus definitions file on another.
Except that the virus definitions file didn't FIT on a "1.44MB" floppy.
Re: (Score:2)
Can you imagine a more epic fail for a virus scanner
Can you all please stop saying "epic fail"? I know /b/ is down, but damn.
Wait one minute. (Score:4, Insightful)
Is it just me or was anyone else surprised that McAfee had any reputation or brand left to piggyback upon? I though McAfee was generally worse than most viruses...
Re: (Score:2)
Re: (Score:2)
The same is true of the other vendors. Symantec and Mcafee are both largely acquisitions companies with great enterprise stuff and crappy consumer stuff.
Re: (Score:2)
Seriously. I constantly fix computers for my friends and family and at least 90% of the time the problem with their computers is mcaffe or norton bogging down their systems. I throw on avg and/or malwarebytes instead. I've never even seen mcaffe or norton find a virus or malware before. AVG and malwarebytes I've gotten countless hits with.
Awesome... (Score:2)
finally forced some accountability for big AV company...hope they stagger and sway before falling down. I really hope they go bankrupt, because everyone wants their money back for their product, and this sets a precedent to all other AV companies....stop screwing us!
conficker (Score:2)
So, the solution to this is obviously to just install conficker/downadup on your computer. McAfee's site should no longer be available after that.
Don't worry, McAfee is safe (Score:2)
I've been trying to sway my boss for months. We're using McCrap. I've been in the malware biz before I turned into a manager type (yeah, the whole three-piece suit and other baggage... don't hurt me please, I'm still one of the good guys), and I know what to expect from McA.
I showed him that page. He looked blank at me and shrugged. He's "pretty sure that others ain't better than that". And "that this could happen to anyone". And that "they should protect us, whether they're secure themselves..." and so on.
McAfee is still pretty terrible (Score:2)
I work IT for a college that used to push out McAfee Enterprise to all desktop machines. We
switched our license/subscriptions/contract and pushed out Sophos right now.
McAfee would randomly mysteriously break and be completely unable to update its scanning engine or dat files, and out of THOUSANDS of desktop machines we'd have a bunch of them with definitions from months or years ago. Which ones? Hell if we knew!
Out of this latest Conficker crap imagine our surprise that McAfee simply didn't recognize the
I've never trusted McAfee (Score:2)
after I spotted a virus that was commonly in the wild and they couldn't identify it in my email 10 years ago. In fact I was very disappointed that McAfee didn't block the damn virus with at least a warning as it was a simple executable file. Norton on the other hand properly identified the virus and warned me about the executable nature of the file. Based on that past experience, I've never trusted McAfee as being worth a damn.
Re: (Score:3, Funny)
Speaking of viruses, that's a nasty cold you've got there.
How do we thow