Campaign Sites Full of Vulnerabilities 36
An anonymous reader writes "Bloggers have been buzzing about the new wave of "Web 2.0" campaign sites, but it seems that a lot of presidential candidates haven't bothered to protect themselves from cross-site scripting attacks. A blogger has found a collection of XSS vulnerabilities including the websites of Barack Obama, Joe Biden, John Edwards, Mitt Romney, John Cox, Newt Gingrich, Tom Tancredo, the Democratic National Committee, and even a surprise from Whitehouse.gov. Some of the holes are low-risk, but others would allow a user's accounts on the affected website to be compromised. A victim would simply have to click on a maliciously crafted link that appears to lead to the candidate's site."
Action (Score:2, Redundant)
Re: (Score:2)
Better to learn now than in a few months or even a year however...
Re: (Score:1)
There are a lot of things that can be done (Score:5, Interesting)
For example: some discussion boards only check the url endings to see if it ends with jpg or gif before allowing you to specify it as your avatar.
Most url shortening sites allow you to add
So if you pick an expanded URL of http://targetsite.com/do=somethingnaughty&foo=
And the shortened URL is say: http://shorturl.org/s/szxvnf
Then you can specify an image to be http://shorturl.org/s/szxvnf/blah.jpg
and it will expand to http://targetsite.com/do=somethingnaughty&foo=/bl
And so something naughty happens without the victim even needing to click on anything.
If the site signs urls with the user's session cookie, and all urls and forms must have a checksum derived from this, then that makes it harder for the attacker.
However, if the attacker manages to inject javascript somewhere, that javascript could figure out the session cookies and other stuff. And that is why javascript is such a risk.
To reduce such risks, I proposed years ago to the W3C and browser makers to have an HTML tag that disables active content, but nobody really seemed interested.
Example:
<shieldson lock="randomstring" allowed="java,vrml,svg"
disallowed material disabled
<shieldsoff lock="randomstring"/>
The attacker has to guess "randomstring" in order to inject active content that's not specifically allowed between <shieldson> and <shieldsoff>. Otherwise the browser will just ignore it (and/or log an error).
Without such tags, HTML is like driving a car with 100 accelerator pedals, but not a single brake pedal. To stop you need to make sure that ALL 100 accelerator pedals are not pressed.
Various people have said: "Just escape stuff correctly". But I think the evidence is that even though in theory people can make sure all 100 "Go" pedals are "escaped", in practice that doesn't happen well enough.
Furthermore, if someone comes up with a new "Go" tag #101, your old escaping libraries might not escape it correctly. Whereas my proposed "brake" tag will have a "default deny" behaviour, the browser should only allow specified active content. So any new type of active content that slips through escaping will still be ignored.
In my opinion the browser makers and browser language makers are not really interested about security.
Oh well...
Re: (Score:2, Funny)
Re: (Score:1)
I'm no programmer, but even I know you don't blindly trust input from a client. This feature might give web developers a false sense of security and lead to further security holes while offering zero real benefit.
I think you misunderstand (Score:2)
The feature I proposed is to help a site protect their users from 3rd party content being displayed on that site.
3rd party content could be webmail being read, comments to a discussion site, search results, adverts.
Say I only allow jpgs and gifs in avatars, so as site owner, I just have the HTML for the avatars looking something like:
<shieldson lock="z34kv85mg925" allowed="image-jpg,image-gif"
<img src="http://3rdpartysite.com/hopefully/this/is/an/ avatar/image
Re: (Score:1)
This is why Slashdot needs an edit/delete post option. That and my oh so clever failure to close that italics tag.
Re: (Score:2)
Anyway, the W3C, browser bunch didn't seem to get it either. Even had someone from Netscape saying: "a server-side library is a more robust solution".
But sites are STILL supposed to use libraries etc to escape stuff! It's supposed to be an _additional_ measure. Argh!
Re: (Score:2)
Hey I surf with javascript turned off too[1].
BUT I do see valid uses for javascript. If my proposal is implemented, I wouldn't mind enabling javascript for some sites that I trust, IF I see they are using that tag to "disarm" content that comes from 3rd parties who I don't necessarily trust (it would be fairly easy to check).
That way I can have the features of javascript and know that it would be much harder for an attacker to inject malicious javascript i
Re: (Score:1)
Question: what purpose, exactly, do these 'URL shortening sites' serve? It seems to me that the length of a URL is pretty much irrelevant, given that you can copy and paste the things. Bonus for Opera users: said browser semi-automates the process of copying a URL from, say, an email and opening it in a new window: highlight URL, right-click, choose 'G
It wouldn't be the first time (Score:1)
Re: (Score:1, Informative)
http://www.tpmmuckraker.com/archives/002200.php [tpmmuckraker.com]
Hackers = America hatin' terrorists? (Score:3, Interesting)
I dare someone (Score:3, Funny)
Re: (Score:1)
Re: (Score:1)
Re:Why are these vulnerabilities? (Score:4, Informative)
Lets say a malicious blogger posts a story about candidate X. He links to a page on candidate X's site that has one of these vulnerabilities. But instead of just creating a normal link, he links in a way that passes some exploit code into the page that alters its behaviour or content. Maybe changing some page content, or injecting Javascript code that sends your cookies for that site to a handler on his blog so that he can collect login information.
To Joe web user, he doesn't know anything is going on. His browser is reporting he is on the authentic Candidate X website (even if it was SSL) but is completely unaware that the content has been altered by a 3rd party, or that his login information is going to get sent to site Y instead of the typical login form handler, etc.
It's not about smart users messing with the page for their OWN amusement, it's about being able to mess with someone else's page with nothing more than a hyperlink (in such a way that doesn't require "hacking" into an account on the local server. Now do you get it?
Re:Why are these vulnerabilities? (Score:4, Informative)
Hmm. Let's see what Mitt Romney [mittromney.com] thinks of your theory.
(disclaimer: probably not what Mitt actually thinks, but you never know.)
Re: (Score:1)
Re: (Score:1)
XSS vulnerabilities (Score:1)
Re: (Score:1)
Re: (Score:2)
All these sites display content from 3rd parties. If they screw up, or a popular browser screws up, pretty naughty stuff can happen.
People complain that "one click buy" is not secure? Hah, you should see "zero click buy"[1] when it happens. And then there's bidding...
Once you can sneak in significant amounts of arbitrary javascript, it's pretty much "pwn3d time".
[1] Perhaps I should patent it, but it's so obvious to any
Clinton in 2008!!! (Score:1)
Could be worse (Score:3, Funny)
Problem might be over-functionality (Score:2)
The summary says that the attacks could compromise user accounts. This raises an interesting question... why do presidential-campaign websites even have accounts for members of the public? What non-cosmetic functionality does that provide that couldn't be done some other way?
Full disclosure: The proliferation of websites that require accounts is a personal pet peeve. There are lots of places where I can't apply for a job or buy something without creating an account, leading to a nasty proliferation of pas
Re: (Score:1)