Slashdot Mirror
Reddit Javascript Exploit Spreading Virally
Nithendil writes "guyhersh from reddit.com describes the situation (warning: title NSFW): Based on what I've seen today, here's what went down. Reddit user Empirical wrote javascript code where if you copied and pasted it into the address bar, you would instantly spam that comment by replying to all the comments on the page and submitting it. Later xssfinder posted a proof of concept where if you hovered over a link, it would automatically run a Javascript. He then got the brilliant idea to combine the two scripts together, tested it and it spread from there."
I don't know. Sounds good !!
seriously. using the 'onhover' event is considered inventive enough to call it a proof of concept?
"NoScript FTW!" comments commencing in 3... 2... 1...
I skimmed the FAQ on the first link, and it seems reddit is responsible for not scrubbing input.
Next!
guyhersh from reddit.com describes the situation (warning: title NSFW)
Does anybody have a SFW link? Something like this certainly must have more than one FA.
Free Martian Whores!
What do you think stops black hats from converting? Easy money? Life outside the "norm"?
Sociopathy, perhaps?
Free Martian Whores!
I'm a long time slashdotter and now spend equal time on reddit. What draws me to reddit is the spartan interface. Of course, the content on reddit is halfway between slashdot's and digg's, so I (unfortunately) have to keep coming back.
Well.. this one was posted before on reddit. *laughts*
So.. yea.
Can anyone post the Javascript code here?, Its probabbly some boring use of ajax, but anyway...
-Woof woof woof!
This is nothing new. There is a quiet tradition of Reddit users finding the weak points of the site, like this for example.
Putting javascript:$(".up").click()() in the address bar upvotes everything on the page.
Reply to That ||
KeyserSosa Thanks for this (and thanks aedes ). I'm going to steal his idea and post here as well. We've fixed a couple of underlying bugs in markdown.py, and will write a blog post for those interested once the dust settles. We've also gone through and deleted the offending comments. This exploit was a good old-fashioned worm, and its only purpose seems to have been to spread (and spread it did). The effect was limited to the site, and no user information was compromised.
So obviously this is no longer spreading.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Over the years I've also spent quite a bit of time on social sites like Slashdot, Fark, Metafilter, Digg,etc.... but now spend the majority of my time on Reddit. I actually like the design (its simple, efficient and useful). But the beauty of Reddit is the organized structure of the sub-reddits. If I'm short for time, i can just quickly browse the frontpage. If I have more time, I can browse my favorite sub-reddits where people know me. The commenting system is easy on the eyes and easy to follow. and the userbase is a nice balance of attitudes.
Hey, everyone, there is a javascript exploit on Reddit! Click on these links to Reddit to learn more.
Incidentally, this old sock smells awful. You should smell it.
Reminds me of a very similar worm that hit myspace years ago:
http://web.archive.org/web/20060208182348/namb.la/popular/tech.html
Same thing, find a way of executing javascript and then have it self-replicate by posting itself all over the site.
Come as you are, do what you must, be who you will.
Years ago I actually proposed to the W3C and the mozilla bunch to add a tag to disable dynamic stuff like javascript.
Basically it would work something like this:
<shield lock="some_random_hard_to_guess_string_here" enabled="basic_html_only">
The browser will only recognize basic HTML stuff here, it won't recognize javascript or any _future_ dynamic stuff that the W3C or browser people think off
</shield unlock="some_random_hard_to_guess_string_here">
The some_random_hard_to_guess_string_here would be different for each page.
The idea is while the website should still have filters, even if in the future the W3C or browser wiseguys create some new fangled way of inserting javascript or some other dynamic content that the filters do not protect against (since it's new and the filters have not been updated), the browser will just ignore the new stuff that some hacker inserts when it's between the tags.
To me the current state of things is a bit crazy - basically it's like having a car with 1000 gas pedals (tags) and to stop the car you have to make sure all 1000 pedals are not pressed (escaped or filtered). There is not a single brake pedal! And worse, the W3C or MS or Mozilla or whoever could introduce a new gas pedal, and you the website operator have to filter out the new gas pedal when it's introduced.
With something like this tag there is a brake pedal, so even if you don't manage to filter out all the 1000 gas pedals, the brake helps to keep stuff safe.
If they had implemented such a tag, the google and myspace worms would not have worked for so many browsers.
FWIW, these sort of worms are not new. I managed to find a hole in advogato some years ago (iframe worm) - and hence my suggestion to the W3C and Mozilla.
But it seems to me than NONE of them are really interested in improving security. They're all just interested in inventing new gas pedals for people (and hackers) to step on. They're not even interested in creating a single brake pedal. They just pay lip service to security.
See the thing is - it's not too difficult to code a browser to go "OK from now on there's no such thing as javascript till I see a valid unlock tag", so even if there is a browser parsing bug and a hacker manages to insert javascript via a stupid browser bug (that the website filters naturally do not and cannot cater for) it does NOT matter - since javascript will be disabled - between those tags the browser will be respecting the flag that says "I do not know javascript, java and all that fancy stuff" - it does not even have to parse javascript - since for all intents and purposes between those tags, the browser does not know there's such a thing as javascript (or activex or flash etc).
This is very useful for sites that have to include 3rd party content - sites like slashdot or webmail sites or even sites that serve up ads from 3rd parties.
Can you imagine the same people in other fields of science?
"...Hey guys, look! I made the black hole generator we were theorizing yesterday! See? I just have to press this button and
It actually works the same way if you read it forwards.
The correct solution is a whitelisted HTML parser and generator, like HTML Purifier.
There are many situations other than forum posting where it is desirable to include third-party content in your site. Advertisements are the first thing that jump to mind, but web widgets are also becoming popular. Having some browser markup that will limit what the third-party code can do would enable this to be done safely, without having to trust the third party or load and filter third-party content server-side.
If your security model is built on everyone else playing nice, you're fucked.
The problem here is in the browser allowing the hijack.
It's not the browser here that's assuming everyone else is playing nice. It's Reddit's site. How were you modded insightful? You're just wrong.
I agree with your sentiment (that you shouldn't assume everyone else is playing nice) but blaming Reddit's problems on browsers misbehaving is like blaming potholes on cars. Sure, nobody crashes if nobody's driving, but potholes are usually caused by ice breaking up the asphalt, not by drivers driving on roads.
Let's place blame where blame is due, ok? It's not the browser's job to police what content can be posted to websites, it's the website's job.