Slashdot Mirror
Campaign Sites Full of Vulnerabilities
An anonymous reader writes "Bloggers have been buzzing about the new wave of "Web 2.0" campaign sites, but it seems that a lot of presidential candidates haven't bothered to protect themselves from cross-site scripting attacks. A blogger has found a collection of XSS vulnerabilities including the websites of Barack Obama, Joe Biden, John Edwards, Mitt Romney, John Cox, Newt Gingrich, Tom Tancredo, the Democratic National Committee, and even a surprise from Whitehouse.gov. Some of the holes are low-risk, but others would allow a user's accounts on the affected website to be compromised. A victim would simply have to click on a maliciously crafted link that appears to lead to the candidate's site."
It's because these are exploits that can be done transparently using nothing more than a carefully crafted hyperlink.
Lets say a malicious blogger posts a story about candidate X. He links to a page on candidate X's site that has one of these vulnerabilities. But instead of just creating a normal link, he links in a way that passes some exploit code into the page that alters its behaviour or content. Maybe changing some page content, or injecting Javascript code that sends your cookies for that site to a handler on his blog so that he can collect login information.
To Joe web user, he doesn't know anything is going on. His browser is reporting he is on the authentic Candidate X website (even if it was SSL) but is completely unaware that the content has been altered by a 3rd party, or that his login information is going to get sent to site Y instead of the typical login form handler, etc.
It's not about smart users messing with the page for their OWN amusement, it's about being able to mess with someone else's page with nothing more than a hyperlink (in such a way that doesn't require "hacking" into an account on the local server. Now do you get it?
Hmm. Let's see what Mitt Romney thinks of your theory.
(disclaimer: probably not what Mitt actually thinks, but you never know.)
Remember when Joe Lieberman's staff lied about his site being hacked and it turned out he just paid for cheap web service and got just what he paid for? And then he cried to the FBI who also found nothing happened:
http://www.tpmmuckraker.com/archives/002200.php