Slashdot Mirror
Campaign Sites Full of Vulnerabilities
An anonymous reader writes "Bloggers have been buzzing about the new wave of "Web 2.0" campaign sites, but it seems that a lot of presidential candidates haven't bothered to protect themselves from cross-site scripting attacks. A blogger has found a collection of XSS vulnerabilities including the websites of Barack Obama, Joe Biden, John Edwards, Mitt Romney, John Cox, Newt Gingrich, Tom Tancredo, the Democratic National Committee, and even a surprise from Whitehouse.gov. Some of the holes are low-risk, but others would allow a user's accounts on the affected website to be compromised. A victim would simply have to click on a maliciously crafted link that appears to lead to the candidate's site."
The responsible action would be to warn each site's administrator of the vulnerability. Regardless of your personal political views.
[Insert pithy quote here]
There really is plenty that can be done nowadays, and the url shortening sites make it possible to do even more "interesting" stuff.
/blah.jpg to the shortened url without grumbling, and they will just append /blah.jpg to the final expanded URL.
a h.jpg
/>
For example: some discussion boards only check the url endings to see if it ends with jpg or gif before allowing you to specify it as your avatar.
Most url shortening sites allow you to add
So if you pick an expanded URL of http://targetsite.com/do=somethingnaughty&foo=
And the shortened URL is say: http://shorturl.org/s/szxvnf
Then you can specify an image to be http://shorturl.org/s/szxvnf/blah.jpg
and it will expand to http://targetsite.com/do=somethingnaughty&foo=/bl
And so something naughty happens without the victim even needing to click on anything.
If the site signs urls with the user's session cookie, and all urls and forms must have a checksum derived from this, then that makes it harder for the attacker.
However, if the attacker manages to inject javascript somewhere, that javascript could figure out the session cookies and other stuff. And that is why javascript is such a risk.
To reduce such risks, I proposed years ago to the W3C and browser makers to have an HTML tag that disables active content, but nobody really seemed interested.
Example:
<shieldson lock="randomstring" allowed="java,vrml,svg"
disallowed material disabled
<shieldsoff lock="randomstring"/>
The attacker has to guess "randomstring" in order to inject active content that's not specifically allowed between <shieldson> and <shieldsoff>. Otherwise the browser will just ignore it (and/or log an error).
Without such tags, HTML is like driving a car with 100 accelerator pedals, but not a single brake pedal. To stop you need to make sure that ALL 100 accelerator pedals are not pressed.
Various people have said: "Just escape stuff correctly". But I think the evidence is that even though in theory people can make sure all 100 "Go" pedals are "escaped", in practice that doesn't happen well enough.
Furthermore, if someone comes up with a new "Go" tag #101, your old escaping libraries might not escape it correctly. Whereas my proposed "brake" tag will have a "default deny" behaviour, the browser should only allow specified active content. So any new type of active content that slips through escaping will still be ignored.
In my opinion the browser makers and browser language makers are not really interested about security.
Oh well...
Remember when Lieberman's website was molested?
Why plug the holes? Blaming "the other guy" for a malicious attack on your web presence makes for such good press.
I dare someone to photoshop moustashes on the candidates pics....
-- www.globaltics.net
Political discussion for a new world
So what the user can inject code into their own browser. What difference does it make? The client is going to hack themselves? Where is the vulnerability?
A few javascript alert boxes and every kid wit a DSL connection is a "hacker". It's a shame that 98/100 of the vulnerabilities out there are this lame ass cross site scripting. What happened to the good old fashioned buffer overflow?!
I've always felt that that they're pretty weak vulnerabilities. Yes they are vulnerabilities but I consider sql injection and remote code execution vulnerabilities much more dangerous. Doesn't someone need to visit your site in order to make the attack work?
This kind of security hole is really prevalent across the web. Campaign sites might be a little worse off because they've only been around for a few months and haven't been stung yet. Also, the political blogging communities just loves to post links to the latest interesting piece of news, gossip, or speculation from non-mainstream sources, so there are plenty of opportunities to slip in a link to a malicious site. If the damage is subtle enough, such as stealing cookies, it might not even be noticed for a while.
It's a simple matter of complex programming.
This is nothing compared to all the holes and open ports I found last time I was at the whitehouse.com site.
I think you misunderstand the usage.
/>/ avatar/image.jpg"> />
/> />
;).
The feature I proposed is to help a site protect their users from 3rd party content being displayed on that site.
3rd party content could be webmail being read, comments to a discussion site, search results, adverts.
Say I only allow jpgs and gifs in avatars, so as site owner, I just have the HTML for the avatars looking something like:
<shieldson lock="z34kv85mg925" allowed="image-jpg,image-gif"
<img src="http://3rdpartysite.com/hopefully/this/is/an
<shieldsoff lock="z34kv85mg925"
Similar thing for sigs, posts, or webmail from spammers/hackers.
<shieldson lock="ad6i5gmp02d" allowed="plain-html,plain-text"
potentially dangerous webmail message here
<shieldsoff lock="ad6i5gmp02d"
Every now and then you hear Yahoo, MySpace, Gmail etc having problems with filtering out content that should not be active, or at least "that active"
If the tags I propose are implemented, they will be a good _safety_net_.
The sites should still try to filter and escape stuff, but this is defense in depth. And it should be compatible with browsers that don't support it - they should ignore unknown tags.
The summary says that the attacks could compromise user accounts. This raises an interesting question... why do presidential-campaign websites even have accounts for members of the public? What non-cosmetic functionality does that provide that couldn't be done some other way?
Full disclosure: The proliferation of websites that require accounts is a personal pet peeve. There are lots of places where I can't apply for a job or buy something without creating an account, leading to a nasty proliferation of passwords. I have an encrypted password-safe, but it's still annoying. There's no reason I couldn't just paste in data from a resume, or give a billing/shipping address and CC number each time.