Slashdot Mirror
Reddit Javascript Exploit Spreading Virally
Nithendil writes "guyhersh from reddit.com describes the situation (warning: title NSFW): Based on what I've seen today, here's what went down. Reddit user Empirical wrote javascript code where if you copied and pasted it into the address bar, you would instantly spam that comment by replying to all the comments on the page and submitting it. Later xssfinder posted a proof of concept where if you hovered over a link, it would automatically run a Javascript. He then got the brilliant idea to combine the two scripts together, tested it and it spread from there."
I don't know. Sounds good !!
seriously. using the 'onhover' event is considered inventive enough to call it a proof of concept?
"NoScript FTW!" comments commencing in 3... 2... 1...
I skimmed the FAQ on the first link, and it seems reddit is responsible for not scrubbing input.
Next!
The guy who did this is clearly intelligent. Although I got hit with this yesterday all I could think about what how clever it was. Too bad he's not using his powers for good (unless you consider taking down reddit good).
What do you think stops black hats from converting? Easy money? Life outside the "norm"?
WTF is reddit anyway?
Interestingly enough, the stories that end up on /. are not infrequently posted several days earlier on Reddit.
Reply to That ||
guyhersh from reddit.com describes the situation (warning: title NSFW)
Does anybody have a SFW link? Something like this certainly must have more than one FA.
Free Martian Whores!
I'm a long time slashdotter and now spend equal time on reddit. What draws me to reddit is the spartan interface. Of course, the content on reddit is halfway between slashdot's and digg's, so I (unfortunately) have to keep coming back.
Well.. this one was posted before on reddit. *laughts*
So.. yea.
Can anyone post the Javascript code here?, Its probabbly some boring use of ajax, but anyway...
-Woof woof woof!
So it's like the Slashdot firehose, except people read it?
wow...
Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
This is nothing new. There is a quiet tradition of Reddit users finding the weak points of the site, like this for example.
Putting javascript:$(".up").click()() in the address bar upvotes everything on the page.
Reply to That ||
KeyserSosa Thanks for this (and thanks aedes ). I'm going to steal his idea and post here as well. We've fixed a couple of underlying bugs in markdown.py, and will write a blog post for those interested once the dust settles. We've also gone through and deleted the offending comments. This exploit was a good old-fashioned worm, and its only purpose seems to have been to spread (and spread it did). The effect was limited to the site, and no user information was compromised.
So obviously this is no longer spreading.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
And the other way around quite often.
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
Over the years I've also spent quite a bit of time on social sites like Slashdot, Fark, Metafilter, Digg,etc.... but now spend the majority of my time on Reddit. I actually like the design (its simple, efficient and useful). But the beauty of Reddit is the organized structure of the sub-reddits. If I'm short for time, i can just quickly browse the frontpage. If I have more time, I can browse my favorite sub-reddits where people know me. The commenting system is easy on the eyes and easy to follow. and the userbase is a nice balance of attitudes.
Hey, everyone, there is a javascript exploit on Reddit! Click on these links to Reddit to learn more.
Incidentally, this old sock smells awful. You should smell it.
Yeah. I've been watching that Carl Sagan autotune video since last Thursday.
Technoli
No, Reddit got this story first. You'll notice that the links in the summary go to Reddit...
(1)DOCOMEFROM!2~.2'~#1WHILE:1<-"'?.1$.2'~'"':1/.1$.2'~#0"$#65535'"$"'"'&.1$.2'~'#0$#65535'"$#0'~#32767$#1"
Reminds me of a very similar worm that hit myspace years ago:
http://web.archive.org/web/20060208182348/namb.la/popular/tech.html
Same thing, find a way of executing javascript and then have it self-replicate by posting itself all over the site.
Come as you are, do what you must, be who you will.
Years ago I actually proposed to the W3C and the mozilla bunch to add a tag to disable dynamic stuff like javascript.
Basically it would work something like this:
<shield lock="some_random_hard_to_guess_string_here" enabled="basic_html_only">
The browser will only recognize basic HTML stuff here, it won't recognize javascript or any _future_ dynamic stuff that the W3C or browser people think off
</shield unlock="some_random_hard_to_guess_string_here">
The some_random_hard_to_guess_string_here would be different for each page.
The idea is while the website should still have filters, even if in the future the W3C or browser wiseguys create some new fangled way of inserting javascript or some other dynamic content that the filters do not protect against (since it's new and the filters have not been updated), the browser will just ignore the new stuff that some hacker inserts when it's between the tags.
To me the current state of things is a bit crazy - basically it's like having a car with 1000 gas pedals (tags) and to stop the car you have to make sure all 1000 pedals are not pressed (escaped or filtered). There is not a single brake pedal! And worse, the W3C or MS or Mozilla or whoever could introduce a new gas pedal, and you the website operator have to filter out the new gas pedal when it's introduced.
With something like this tag there is a brake pedal, so even if you don't manage to filter out all the 1000 gas pedals, the brake helps to keep stuff safe.
If they had implemented such a tag, the google and myspace worms would not have worked for so many browsers.
FWIW, these sort of worms are not new. I managed to find a hole in advogato some years ago (iframe worm) - and hence my suggestion to the W3C and Mozilla.
But it seems to me than NONE of them are really interested in improving security. They're all just interested in inventing new gas pedals for people (and hackers) to step on. They're not even interested in creating a single brake pedal. They just pay lip service to security.
See the thing is - it's not too difficult to code a browser to go "OK from now on there's no such thing as javascript till I see a valid unlock tag", so even if there is a browser parsing bug and a hacker manages to insert javascript via a stupid browser bug (that the website filters naturally do not and cannot cater for) it does NOT matter - since javascript will be disabled - between those tags the browser will be respecting the flag that says "I do not know javascript, java and all that fancy stuff" - it does not even have to parse javascript - since for all intents and purposes between those tags, the browser does not know there's such a thing as javascript (or activex or flash etc).
This is very useful for sites that have to include 3rd party content - sites like slashdot or webmail sites or even sites that serve up ads from 3rd parties.
Can you imagine the same people in other fields of science?
"...Hey guys, look! I made the black hole generator we were theorizing yesterday! See? I just have to press this button and
Come for the stories. Stay for the comments!
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
its a bunch of overly-excited people talking about an exploit until it goes away.
Good people go to bed earlier.
Incidentally, I went to mod this and it failed... multiple times.
Though it eventually worked, I am not impressed.
It seems that Slashdot is so horribly broken and inconsistent as to be immune to such exploits.
Speaking of irony...
(I confess, it was me)
Almost as soon as people realized there was something strange going on, the programming subreddit started discussing the code.
http://www.reddit.com/r/programming/comments/9oobq/someone_put_a_malicious_java_script_comment_on_at/
http://www.reddit.com/r/programming/comments/9oo8j/source_code_for_the_redditfirefox_exploit/
Oh cool, now I can finally create the signature virus!
If your security model is built on everyone else playing nice, you're fucked.
The problem here is in the browser allowing the hijack.
n/t
The correct solution is a whitelisted HTML parser and generator, like HTML Purifier.
Back in the old days, there was a mod button at the bottom of the screen. You had to mod all your comments in batch.
Lower ranked comments were hidden separate "Too many comments" pages and if you clicked one of those links to read them, you would lose all your mod selections. When I got Firefox (Phoenix at the time), tabbed browsing made the process so much easier.
There are many situations other than forum posting where it is desirable to include third-party content in your site. Advertisements are the first thing that jump to mind, but web widgets are also becoming popular. Having some browser markup that will limit what the third-party code can do would enable this to be done safely, without having to trust the third party or load and filter third-party content server-side.
OK, consider this assertion:
Web pages and web applications are different, so perhaps we need a new URL type?
Consider: the original purpose of HTTP was HyperTEXT Transport protocol: a means to have linked TEXT pages. Thus, such pages were not a Turing Complete language (indeed, they weren't any form of "active" language at all, just a markup presentation layer). As such, they were simple to evaluate from a security protocol standpoint.
Since then, the web has evolved into a collection of Web pages (text, graphics, but basically NOT "active") and Web Applications (things like Google Maps).
To be an "active" page pretty much requires a Turning Complete language, and it is impossible to fully say that a Turing Complete language is "safe" (at a minimum, you cannot guarantee halting, so you have a denial of service attack if nothing else).
What if we separate the idea of a "Web Page" and a "Web Application", and put certain rules on each (web pages should not require Turing Complete behavior to operate, Web Applications should be bounded in where the fetch code from)? When the user selects a Web Application, the browser can check if the application has been cleared to run by the user previously, and if not, ask them "You have selected to run a web application 'FutzorJooMachine' from 'evilbad.example.com' - are you sure?" Ideally, the web application should provide to the browser a list of sites and components it plans on using (and the browser should ENFORCE that only those items are used).
Now, if the only difference between a Web Page and a Web Application is the MIME type, then you are going to have a hard time letting the user know when he is about to step on a mine - so what if we create a new transport type, "WATP" (Web Application Transport Protocol), which is the same as HTTP in implementation but has a different default link type, and different permissions from the browser.
That way, things that are supposed to be Web Pages (Yes, 'You Cannot Delete Messages Without Javascript'-Slashdot I am looking at you) can be constrained to a safe set of behaviors (as in NO JAVASCRIPT OF ANY FORM, INCLUDING FLASH), and the web apps can be identified as such and allowed to do what they need to do AT THE USER'S DISCRETION.
www.eFax.com are spammers
Java compilers prove the type safety of the bytecode and the runtime verifies the proof before it runs. Depending on the amount of work you want to do, you can prove just about any property about a specific program, and require any arbitrary program you want to use to provide its own proof of safety/correctness that can be formally verified before you run it.
While it's an interesting idea, it has one fatal problem: most end-users don't understand what the browser presents to them, and they'll just do whatever necessary to make it go away. This even applies to a large percentage of otherwise tech-savvy people. The end result will be people allowing everything, because surely their cousin Steve wouldn't send them a malicious link?
Three simple regexes will solve all xss exploits on a page submission:
$submission=preg_replace('/on(\w)=/' , 'on<span style="display:none"> this is not an event </span>${1}=', $submission);
$submission=preg_replace('/javascript/' , 'j<span style="display:none"> this is not js </span>avascript', $submission);
$submission=preg_replace('/<object/' , '<object', $submission);
It can result in invalid, funny looking html, but the idea is to have a backstop after your other striptags / stripattributes functions. Run these two lines just before saving the submission and you have no worries.
"For me, the solution is to just whitelist the sites I visit frequently, only allowing scripts/cookies when I know they can be trusted." - by Anonymous Coward on Monday September 28, @10:21AM (#29565353)
See subject-line, because you have hit it right on the head perfectly as far as I am concerned personally. Opera makes this the easiest to do, imo @ least, via first GLOBALLY disabling javascript on all sites (via the tools menu, preferences option, advanced tab, content item OR via tools quick preferences).
Then, I 'whitelist' (allow) a site to use javascript, when I cannot use said site without javascript (done via right-clicking on the page itself, & using the popup menu & the item entitled "Edit Site Preferences"... thus, allowing it to use javascript (& only it or others I do this for).
This cuts WAY down on the possibles of WHERE I may have gotten infested (I never really do though, because I use a HOSTS file that is kept up to date weekly if not daily, from reputable sources such as -> SpyBot "Search & Destroy" via its "immunize" feature, ZDNet's Mr. Dancho Danchev's blogspot here -> http://ddanchev.blogspot.com/ & also SRI, here -> http://mtc.sri.com/ as well as other reputable & kept-up-to-date HOSTS files listed here @ wikipedia -> http://en.wikipedia.org/wiki/Hosts_file
APK
P.S.=> It works, & I haven't been infected/infested in more than a DECADE++ because of this practice... apk
So we'll take HTTP and _call_ it WATP, then make everything that has _nothing_ to do with transport protocols behave differently. And it'll save the world.
Are you from Marketing, perchance?
javascript pseudo protocol
lol. He proved it huh? It's called onmouseover and you could use it to do whatever you like with javascript, same as onclick or any other event.
What he did was take advantage of a flaw in Reddit's comment system. This is not a 'javascript exploit'.
FAQs are evil.