Full Disclosure mailing list archives
RE: SUPER SPOOF DELUXE Re: Microsoft and Security
From: "Thor Larholm" <thor () pivx com>
Date: Thu, 1 Jul 2004 18:00:07 -0700
From: Pavel Kankovsky [mailto:peak () argo troja mff cuni cz]
If a script from site A can replace the contents of a frame within a document from site B then site A is able to violate the *integrity* of B's contents. This is unacceptable.
A script from site A can only replace the contents of a window object within a frame from site B if site B is specifically opened through scripting from site A. Site A cannot interact with any window object that it has not created itself, it has to open a new window, wait for it to load and then load a new document in the frame inside this new window. It doesn't even know if you already have an existing browser window pointing at WindowsUpdate or your banking site because it didn't open those windows. You have to look at the prerequisite attack scenario. You are surfing to some random site and out of nowhere it opens WellsFargo.com or WindowsUpdate. At this point you are thinking one of 2 things, either "What the.. I didn't go to WindowsUpdate/WellsFargo .. Let me just close that window .. Damn popups" or "Hey how nice, WindowsUpdate/WellsFargo magically appeared in front of me and I didn't even intend to go there .. I was just surfing for porn .. Let me hurridly download some stuff from there and give it my account details" Thor _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: SUPER SPOOF DELUXE Re: Microsoft and Security http-equiv () excite com (Jul 01)
- Re: SUPER SPOOF DELUXE Re: Microsoft and Security Daniel Veditz (Jul 02)
- <Possible follow-ups>
- RE: RE: SUPER SPOOF DELUXE Re: Microsoft and Security http-equiv () excite com (Jul 01)
- RE: SUPER SPOOF DELUXE Re: Microsoft and Security http-equiv () excite com (Jul 01)
- RE: SUPER SPOOF DELUXE Re: Microsoft and Security Thor Larholm (Jul 01)
- RE: SUPER SPOOF DELUXE Re: Microsoft and Security Pavel Kankovsky (Jul 01)
- RE: RE: SUPER SPOOF DELUXE Re: Microsoft and Security Thor Larholm (Jul 01)
- RE: SUPER SPOOF DELUXE Re: Microsoft and Security Thor Larholm (Jul 01)
- Re: SUPER SPOOF DELUXE Re: Microsoft and Security Bob Perriero (Jul 02)
- RE: RE: SUPER SPOOF DELUXE Re: Microsoft and Security http-equiv () excite com (Jul 01)
- Re: RE: SUPER SPOOF DELUXE Re: Microsoft and Security Gregory A. Gilliss (Jul 01)
- Re: RE: SUPER SPOOF DELUXE Re: Microsoft and Security John Sage (Jul 02)
- RE: RE: SUPER SPOOF DELUXE Re: Microsoft and Security Mark Laurence (Jul 02)
- Re: RE: SUPER SPOOF DELUXE Re: Microsoft and Security Gregory A. Gilliss (Jul 01)