On 14 Oct 2005, at 21:29, Reynolds, Jake wrote:
I wouldn't consider this an XSS attack. Where in the attack did
information cross sites? This seems
like it is an embedded XSS attack in that a malicious script was
entered into a profile in hopes that
victims would view and execute it. However, nothing was sent across
sites via the script. The
vulnerability was a lack of output validation in my opinion, which
is the same vulnerability that an
XSS attack would exploit. I don't know how you would classify the
attack... Probably "self-replicating
session riding". Yeah that has a nice FUD-factor to it.
The term "Cross Site Scripting" was a bit poorly chosen, and is more
than a little misleading. This attack _is_ a classic example of
Cross Site Scripting since the user executed a script that did not
come from the trusted site but came from an attacker instead. Yes,
technically it may have been embedded in the site, but it was created
by the attacker. I think you're following a very literal definition
of what a XSS attack is, i.e. that the script actually has to come
from another site - it doesn't; as long as it comes from an untrusted
source, in this case the untrusted source was the initial attack
embedded in the attacker's own profile.
So this is really an example of a persistent, or second order Cross
Site Scripting attack. http://en.wikipedia.org/wiki/Cross_site_scripting
Stephen
-----Original Message-----
From: Chris Varenhorst [mailto:varenc@MIT.EDU]
Sent: Thursday, October 13, 2005 8:39 AM
To: Akash
Cc: webappsec@securityfocus.com
Subject: Re: myspace hack
Oh wow I'm wrong, I'm apparently thinking of current myspace bots
which do
as I described. It looks this was in fact made possible by an XSS
vulnerability.
Sorry
On Thu, 13 Oct 2005, Chris Varenhorst wrote:
This isn't hacking at all. (at least not what I'd call it)
This is writing a script to go through myspace IDs (which happen
to be
squential) issuing friend requests to every one of them. To prevent
this, now myspace limits friend requests to a certain number per day.
Hope that covers it!
-Chris
On Thu, 13 Oct 2005, Akash wrote:
Does anyone has more technical details about how 1 million accounts
got hacked in about 24 hours.
This is the supposed confession of the hacker
http://fast.info/myspace/
I currently studying for CEH and just finished reading about XSS. So
this is of special interest.
regards
akash
