Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security The Internet

McAfee Sites Vulnerable To XSS Attack 84

Posted by kdawson from the unguarded-guardians dept.
An anonymous reader notes that this weekend, ReadWriteWeb discovered a security hole on several McAfee sites, which lets any attacker piggyback on the company's reputation and brand in order to distribute malware, Trojans, or anything else. The submitter adds an ironic coda to McAfee's epic fail: "In the 'how to HTML Injection' section, the author provided the four steps needed to execute a simple, no-brainer injection, but unfortunately, exposed a hole in NY Times website when they republished the article. While the author changed the offending text to an image, the Times is still using the original story which redirects directly to ReadWriteWeb [via XSS]." From the RWW post: "During tests this weekend, we discovered the company who claims to 'keep you safe from identity theft, credit card fraud...' has several cross-site scripting vulnerabilities and provides the bad guys with a brilliant — albeit ironic — launching pad from which to unleash their attacks."
This discussion has been archived. No new comments can be posted.

McAfee Sites Vulnerable To XSS Attack More

McAfee Sites Vulnerable To XSS Attack

Comments Filter:

  • Epic fail (Score:2, Funny)

    by xming ( 133344 )

    Horribly.

    • Re: (Score:1, Redundant)

      by Jaysyn ( 203771 )

      McAfail?

  • Hmm. (Score:3, Interesting)

    by Phroggy ( 441 ) <slashdot3@@@phroggy...com> on Tuesday May 05, 2009 @04:59AM (#27827933) Homepage

    Yikes. I wonder if any of my code has that vulnerability. I don't think so. I try to make sure I run all user-submitted text through something to escape those kinds of characters before sending it back to the browser as HTML, but it's possible I could have missed something somewhere. The only time I don't do this is if the user-submitted input is first passed through an input validator that should reject anything containing dangerous characters (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address). But how can I be sure I haven't missed anything somewhere?

    The only way I could be sure is if I did a thorough audit of all my web site code, and I really don't want to go through that hassle. It's probably fine. I've never had an XSS attack used successfully against any site I've built. Certainly not one that was using SSL. So let's just assume that this trend will continue!

    Right?

    • Re:Hmm. (Score:4, Insightful)

      by 6Yankee ( 597075 ) on Tuesday May 05, 2009 @05:06AM (#27827963)

      The only time I don't do this is if the user-submitted input is first passed through an input validator that should reject anything containing dangerous characters (for example, a valid e-mail address cannot contain HTML tags, so if I reject all but a valid e-mail address, then I don't need to sanitize the e-mail address). But how can I be sure I haven't missed anything somewhere?

      Ouch. I can disable the client-side validation entirely. I can also write my own form and send you anything I like.

      Sanitize everything.

      • Re: (Score:1, Insightful)

        by Anonymous Coward
        Informative? Where does he say it's client-side?

        I try to make sure I run all user-submitted text through something to escape those kinds of characters before sending it back to the browser as HTML

        Guess where he sends it back from, numbnuts.

        • Re: (Score:2)

          by 6Yankee ( 597075 )
          I would have thought the clue was in this part: user-submitted Unless, of course, his users all have logins on his server.

          • User submitted implies that he's talking about server side validation of the received POSTed data. Also he specifies that he is properly escaping dangerous characters before sending the response BACK to the browser.

            No where could it be interpreted as client-side validation.

            • Re: (Score:2)

              by Phroggy ( 441 )

              User submitted implies that he's talking about server side validation of the received POSTed data. Also he specifies that he is properly escaping dangerous characters before sending the response BACK to the browser.

              Yes, this is precisely what I meant.

              I normally implement server-side input validation first, test it, then add client-side input validation in JavaScript.

              On the server side, once it's been through input validation, then anything that needs to be sent back to the browser is escaped (run through a function that converts characters like greater-than/less-than symbols to HTML entities, etc.), but I often skip this for data that is known to be safe because it would have failed input validation if it wasn't (e.g.

              • OP means he copies the offending URL to the clipboard, mungs it, and THEN pastes it to the location bar (URL bar ("awesome bar" in firefox)). JS is not involved at all.

          • Re: (Score:2)

            by wazzzup ( 172351 )

            User-submitted doesn't imply client-side (javascript) validation. I always sanitize user-submitted content via PHP. Of course, replace PHP with Ruby, ASP, Java or whatever other server-side language you're using. It's pretty hard for a user to manipulate server-side code without a login shell to the webserver or a really brain-dead server setup.

    • Re: (Score:3, Insightful)

      by Swizec ( 978239 )
      For the safety of your users, I do hope the sanitization happens on the server-side otherwise ... yikes. Then again, some clients simply don't pay enough for sanitization and I just dump anything someonen posts right back to the page. Easier spending an hour every two months deleting "spam" than spending time making sure everything gets properly sanitized.

      Yes I'm a lazy coder I know, but fuck it, you get what you pay for.

      • Re:Hmm. (Score:5, Insightful)

        by AlXtreme ( 223728 ) on Tuesday May 05, 2009 @05:35AM (#27828059) Homepage Journal

        Yes I'm a lazy coder I know, but fuck it, you get what you pay for.

        Do it right, or don't do it at all.

        I'm all for cutting corners when dealing with stingy clients (which tend not to be clients for long) so I get your way of thinking, but basic security shouldn't be one of the corners to cut. In the end it will be worthwhile to simply add a bit of code to sanitize user input to avoid all the hassle you'll get in the long run.

        If you are spending an hour (of your own or billed) every two months for cleaning up crap, next time please spend two hours and add some validation. Keep on billing said client for spam cleanups for all I care.

        Every time a viewer sees spam it makes your work seem poor. Even a lazy coder knows when it will cost him more work in the long run.

      • Re: (Score:1)

        by joost ( 87285 )

        Yes I'm a lazy coder I know, but fuck it, you get what you pay for.

        Holy fuck how lazy do you have to be to NOT put htmlspecialchars() around browser-facing strings?? In Rails it's even simpler. Come on!

    • Re:Hmm. (Score:4, Interesting)

      by growse ( 928427 ) on Tuesday May 05, 2009 @05:18AM (#27827995) Homepage
      I find it easiest to not validate anything on input, because I don't know what my output is necessarily going to be - could be HTML, could be PDF (for example). If I am outputting to non-HTML I don't want to wade through HTML-encoded soup to get something sensible back out.

      If I'm outputting to web, I then always validate / encode *all* content, usually using something like the Microsoft AntiXSS library. This stops user-inputted markup from being rendered, but it also stops markup that's been maliciously inserted into your database from being remembered. Remember the SQL injection attack that appended a javascript snippet to every field it could find? It was looking to do an XSS attack.

      If you need to chuck out user-generated markup, make sure you contstruct your whitelist and ruleset very carefully.

      • Re: (Score:2)

        by Phroggy ( 441 )

        I find it easiest to not validate anything on input, because I don't know what my output is necessarily going to be - could be HTML, could be PDF (for example). If I am outputting to non-HTML I don't want to wade through HTML-encoded soup to get something sensible back out.

        What I mean by input validation is aborting with an error if the user has submitted invalid data, e.g. entering "foo" in an e-mail address field. Nothing is encoded or escaped at this point. If I need to store it in a database, the data is stored as-is, using the Perl DBI's automatic escaping feature to make sure SQL injection attacks aren't possible (I can think of one occasion [phroggy.com] when this wasn't adequate and I had to wring my own routine). Whatever else I need to do with the data, any necessary escaping

        • Re: (Score:2)

          by growse ( 928427 )

          What I mean by input validation is aborting with an error if the user has submitted invalid data, e.g. entering "foo" in an e-mail address field. Nothing is encoded or escaped at this point. If I need to store it in a database, the data is stored as-is, using the Perl DBI's automatic escaping feature to make sure SQL injection attacks aren't possible (I can think of one occasion [phroggy.com] when this wasn't adequate and I had to wring my own routine). Whatever else I need to do with the data, any necessar

    • Re:Hmm. (Score:5, Informative)

      by galego ( 110613 ) <jsnsotheracct AT gmail DOT com> on Tuesday May 05, 2009 @05:44AM (#27828093)
      Hope you're not trying to "enumerate the bad" (i.e looking at $foo ~= /<script/i in the input ... or even '<'). There are lots of ways to escape such validators. A great resource on some is here: http://ha.ckers.org/xss.html [ckers.org] I say, unescape everything back to the browser (even email addresses). OWASP has a good resource: http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet [owasp.org]

  • Eat their own dog food (Score:3, Insightful)

    by agristin ( 750854 ) on Tuesday May 05, 2009 @05:02AM (#27827945) Journal

    Either they don't use McAfee secure ( http://www.mcafeesecure.com/us/ [mcafeesecure.com] Probably the right website, who knows really ), or their own dog food is garbage.

    Either way it is bad gaffe. XSS is pretty well known in security circles. And this mistake is a relatively simple one (output validation or output filtering? please. After you read the linked article, you'll be even more sad they didn't catch this.

  • Syndicated version on NYT site (Score:5, Informative)

    by Anonymous Coward on Tuesday May 05, 2009 @05:04AM (#27827953)

    http://www.nytimes.com/external/readwriteweb/2009/05/04/04readwriteweb-mcafee-enabling-malware-distribution-and-fr-12208.html

    executes the code and redirects to readwriteweb.com

  • Distribute? (Score:2, Insightful)

    by Haiyadragon ( 770036 )
    Sure, I can use this to inject code into the html that is then processed by my webbrowser. But how I can use this type of XSS to distribute anything? The worst thing I can do is still only happening on my pc.

    • Re:Distribute? (Score:5, Informative)

      by Hurricane78 ( 562437 ) <deleted&slashdot,org> on Tuesday May 05, 2009 @05:47AM (#27828103)

      Well, it injects code that can change the download link to a trojan that wraps the original thing. In your webbrowser.

      In sites with logins and other user-private data, well, let me take Slashdot as an example.
      Imagine someone got some evil code into the site, that your browser would load and execute.
      That code could quickly put the entire page into a frameset, with the outside being the control channel.
      Then, while you were reading, it would load your unprotected profile in the background, and change your sig to that same evil code (or a link to it). So everybody else would get it too.
      Then it would do a complete scan of your internal network, possibly detecting your router, and its ports. (All possible with JavaScript. Been there, seen it.)
      You could click on a link in /., and the frameset would survive. You could even keep that tab open all day long, effectively making you a zombie host.
      In the process, it would accept arbitrary commands from the controlling system. If you happen to go on the site or your router, it could for example try things in there too, like set an external control IP to the controlling system, and gain full access to your own network. (Unlikely, but I've seen it happening.)

      And all this is just the tip of the iceberg.

      • I think the parent's point is that the data submitted to McAfee's database and subsequently rendered back out on the following page is PERSONAL data belonging to you, and is unlikely to be seen by anyone else.

        It's like making a purchase online ... at what point would anything you submitted (name, address, credit card number etc), be rendered back out for a third party to view ?

        Notwithstanding it's a poorly designed website, the mitigation is that anything YOU submit is unlikely to cause a third party to fal

        • Come on. That one is nearly too simple to answer: Is there any way at all, to submit non-personal data on that site?

          If yes, then the code that is rendered personally for you can submit that too.

          Also, I have a tip for you: People who try to emphasize words by writing them all-caps, look like aggressively screaming idiots. Not what you would want to have associated with your arguments, if you really want to convince others. You know... offended people have the habit of not taking you very serious, no matter i

        • 1) You make a purchase, inject javascript into your address. The administrator goes to the website to print shipping labels. Now you control the administrator.

          2) You log in. Later that day, you're visiting evil.com, which loads the site in the background, with payload, and slurps data off of it.

      • Sure an arbitrary website can present the vulnerable website with injected code, but this code can't do anything javascript cannot already do directly. Which, in a reasonably secure browser, is not a whole lot.

      • "In your webbrowser."

        I think you meant "In your web browser as long as you're running Windows. If you're not running Windows you really don't need to care - just have a good laugh instead".

        • the XSS affects all browsers, that's the point. It can be easilly used as part of a phishing scam, where the only defence is a clued-up user. And Linux users *may* end up at Mcafee's site, if they're running this [mcafee.com] or this [mcafee.com]

          • Re: (Score:2)

            by Viol8 ( 599362 )

            XSS affecting all browsers is irrelevant if its main line of attack is a win32 trojan. Can't say I'm bothered about javascript malware , its a crippled language and will exit as soon as I close the tab anyway.

      • Then it would do a complete scan of your internal network, possibly detecting your router, and its ports. (All possible with JavaScript. Been there, seen it.)

        I'd really like to see a source on that. In any reasonably current browser, you can't even read the local IP address with JavaScript [you can, if you use applets, but that's something quite different]. I highly doubt you could do anything like you describe with JS alone, unless the user happens to be running ancient software without security updates. In that case, he gets what he deserves.

        CJ

  • Sure, but the camel was already broken... (Score:5, Interesting)

    by wild_quinine ( 998562 ) on Tuesday May 05, 2009 @05:32AM (#27828047)
    I found an old USB stick the other day with McAfee's superdat (definitions and engine update) file circa 2006. That's only two and a half years ago. It was a real wake-up call. The superdat was just over 6mb in size.

    These days you can't fit the application and latest superdat onto a 128mb stick - and when I tell you that the application in only 20mb in size, you'll realise what a change this is. Their updates been spiralling out of control for two years. Now, some may argue that there's a lot more malware out there now, and I won't disagree. But I will say this: McAfee hasn't been getting significantly better as far as I can tell, and none of the other major players seem to have experienced this definitions file explosion, ergo McAfee is doing something wrong.

    Furthermore, their version 8 enterprise has one of the worst failures I've ever seen for a virus scanner, which is hilariously related to the above. The application no longer knows how to handle its own virus defintions catalog: I'm not sure whether that's the sheer size, or the number of entries, but either way the update fails because of it. But get this: it says that the update has succeeded!

    Can you imagine a more epic fail for a virus scanner than saying it's up to date, but being wrong? Neither could I, till I read the news today.

    So long McAfee, I hope you enjoyed your time with the big players.

    • Re: (Score:3, Interesting)

      by drinkypoo ( 153816 )

      Furthermore, their version 8 enterprise has one of the worst failures I've ever seen for a virus scanner, which is hilariously related to the above. The application no longer knows how to handle its own virus defintions catalog: I'm not sure whether that's the sheer size, or the number of entries, but either way the update fails because of it. But get this: it says that the update has succeeded!

      They were just trying to catch up to Norton/Symantec Antivirus, which has had this feature since version 7 (I ran into it ENDLESSLY at Yuba College.) The fix was to reinstall windows (ever tried manually removing norton? heh heh) and run virus def updates manually. The problem remained at least until version 9, which is what they were running when I quit.

    • Comment removed based on user account deletion

    • Back in the day I had hilarious fun trying to use Norton's (I think) tool for making a bootable virus scan disk.

      It put the bootable OS and virus scanner on one floppy, and the virus definitions file on another.

      Except that the virus definitions file didn't FIT on a "1.44MB" floppy.

    • Re: (Score:2)

      by MagicM ( 85041 )

      Can you imagine a more epic fail for a virus scanner

      Can you all please stop saying "epic fail"? I know /b/ is down, but damn.

  • Wait one minute. (Score:4, Insightful)

    by Lifyre ( 960576 ) on Tuesday May 05, 2009 @07:08AM (#27828423)

    Is it just me or was anyone else surprised that McAfee had any reputation or brand left to piggyback upon? I though McAfee was generally worse than most viruses...

    • Re: (Score:2)

      by rindeee ( 530084 )
      Actually, their enterprise class stuff is outstanding. I don't use any of their "home user" level stuff, but for my money, McAfee beats the pants off of other high-end offerings. Their IDS, mail filtering, etc. (much of it acquired over the years) is outstanding product.

      • Re: (Score:2)

        by jotok ( 728554 )

        The same is true of the other vendors. Symantec and Mcafee are both largely acquisitions companies with great enterprise stuff and crappy consumer stuff.

  • rant:
    At my college you aren't allowed on the network if you run windows and don't install Cisco crapware.

    This crapware checks for an antivirus, and if you don't have one the school will install one for you.

    Guess what they install McAfee 8.5 as their licensed AV software.

    McAfee has horrendous trouble updating its definitions, especially when it's used in conjunction with Cisco crapware. Its actual usefulness is a joke, and has anyone ever tried to whitelist a program with it.

  • there is a really good post on it here http://www.xssed.com/news/92/XSS_Iframe_injections_and_XMLHTTP_post_request_errors_on_McAfee_sites/ [xssed.com] and http://www.xssed.com/archive/domain=mcafee.com [xssed.com] shows sites in the past XSSable http://xssed.com/ [xssed.com] keeps track of a lot of XSSed sites

  • finally forced some accountability for big AV company...hope they stagger and sway before falling down. I really hope they go bankrupt, because everyone wants their money back for their product, and this sets a precedent to all other AV companies....stop screwing us!

  • So, the solution to this is obviously to just install conficker/downadup on your computer. McAfee's site should no longer be available after that.

  • I've been trying to sway my boss for months. We're using McCrap. I've been in the malware biz before I turned into a manager type (yeah, the whole three-piece suit and other baggage... don't hurt me please, I'm still one of the good guys), and I know what to expect from McA.

    I showed him that page. He looked blank at me and shrugged. He's "pretty sure that others ain't better than that". And "that this could happen to anyone". And that "they should protect us, whether they're secure themselves..." and so on.

  • I work IT for a college that used to push out McAfee Enterprise to all desktop machines. We
    switched our license/subscriptions/contract and pushed out Sophos right now.

    McAfee would randomly mysteriously break and be completely unable to update its scanning engine or dat files, and out of THOUSANDS of desktop machines we'd have a bunch of them with definitions from months or years ago. Which ones? Hell if we knew!

    Out of this latest Conficker crap imagine our surprise that McAfee simply didn't recognize the

    • Re: (Score:1)

      by Nos. ( 179609 )

      You must not be using ePO, or using it correctly. I'm new to it, and running an old version (3.6.1) but I can tell you in a matter of minutes, how many machines (of around 5000) are running the most current dat files, and how many aren't. I can very quickly get a list of machines running any version but the most current (though I usually only care about machines that are more than a few versions out of date).

      If the engine does happen to break (which has happened, but is pretty rare), I can use ePO to rein

    • McAfee would randomly mysteriously break and be completely unable to update its scanning engine or dat files, and out of THOUSANDS of desktop machines we'd have a bunch of them with definitions from months or years ago. Which ones? Hell if we knew!

      You have thousands of machines but didn't use ePO? McAfee does suck, but you are fucking terrible.

  • An anonymous reader notes that this weekend, ReadWriteWeb discovered a security hole on several McAfee sites, which lets any attacker piggyback on the company's reputation and brand in order to distribute malware, Trojans, or anything else.

    Isn't McAfee already considered to be malware? Perhaps they hate the idea of competition in the malware distribution business.

  • after I spotted a virus that was commonly in the wild and they couldn't identify it in my email 10 years ago. In fact I was very disappointed that McAfee didn't block the damn virus with at least a warning as it was a simple executable file. Norton on the other hand properly identified the virus and warned me about the executable nature of the file. Based on that past experience, I've never trusted McAfee as being worth a damn.

  • This promises to be an interesting bit of crying material for some customers that I'll deal with here.

    I get callers using McAfee, and they tend to get infected for some reason or another (I don't care why -- not in my pay grade). Apparently, I should be expecting to hear over the next few days, "Hey, I clicked on a link in my email to upgrade my McAfee, and I think I have a virus. :("

    Why?

    Because SHEEPLE CLICK ON ANYTHING.

    Fortunately, it looks like McAfee has rushed to put some caulk in those holes, so the f

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Close