McAfee Sites Vulnerable To XSS Attack 84
An anonymous reader notes that this weekend, ReadWriteWeb discovered a security hole on several McAfee sites, which lets any attacker piggyback on the company's reputation and brand in order to distribute malware, Trojans, or anything else. The submitter adds an ironic coda to McAfee's epic fail: "In the 'how to HTML Injection' section, the author provided the four steps needed to execute a simple, no-brainer injection, but unfortunately, exposed a hole in NY Times website when they republished the article. While the author changed the offending text to an image, the Times is still using the original story which redirects directly to ReadWriteWeb [via XSS]." From the RWW post: "During tests this weekend, we discovered the company who claims to 'keep you safe from identity theft, credit card fraud...' has several cross-site scripting vulnerabilities and provides the bad guys with a brilliant — albeit ironic — launching pad from which to unleash their attacks."
Eat their own dog food (Score:3, Insightful)
Either they don't use McAfee secure ( http://www.mcafeesecure.com/us/ [mcafeesecure.com] Probably the right website, who knows really ), or their own dog food is garbage.
Either way it is bad gaffe. XSS is pretty well known in security circles. And this mistake is a relatively simple one (output validation or output filtering? please. After you read the linked article, you'll be even more sad they didn't catch this.
Re:Hmm. (Score:4, Insightful)
The only time I don't do this is if the user-submitted input is first passed through an input validator that should reject anything containing dangerous characters (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address). But how can I be sure I haven't missed anything somewhere?
Ouch. I can disable the client-side validation entirely. I can also write my own form and send you anything I like.
Sanitize everything.
Re:Hmm. (Score:3, Insightful)
Yes I'm a lazy coder I know, but fuck it, you get what you pay for.
Re:Hmm. (Score:1, Insightful)
I try to make sure I run all user-submitted text through something to escape those kinds of characters before sending it back to the browser as HTML
Guess where he sends it back from, numbnuts.
Distribute? (Score:2, Insightful)
Re:Hmm. (Score:5, Insightful)
Do it right, or don't do it at all.
I'm all for cutting corners when dealing with stingy clients (which tend not to be clients for long) so I get your way of thinking, but basic security shouldn't be one of the corners to cut. In the end it will be worthwhile to simply add a bit of code to sanitize user input to avoid all the hassle you'll get in the long run.
If you are spending an hour (of your own or billed) every two months for cleaning up crap, next time please spend two hours and add some validation. Keep on billing said client for spam cleanups for all I care.
Every time a viewer sees spam it makes your work seem poor. Even a lazy coder knows when it will cost him more work in the long run.
Wait one minute. (Score:4, Insightful)
Is it just me or was anyone else surprised that McAfee had any reputation or brand left to piggyback upon? I though McAfee was generally worse than most viruses...
Re:Antivirus on Windows (Score:4, Insightful)
Great idea. (Score:2, Insightful)
Firefox + noscript will block XSS attempts.
Yes. We know.
Firefox + NoScript will block [INSERT WEBSPLOIT HERE].
NoScript also kinda prevents nearly everything on the web from working as intended, and is not a solution. Please shut up about how much you think it rocks.