WebApp Sec mailing list archives
Re: myspace hack
From: Stephen de Vries <stephen () corsaire com>
Date: Fri, 14 Oct 2005 21:55:37 +0700
On 14 Oct 2005, at 21:29, Reynolds, Jake wrote:
I wouldn't consider this an XSS attack. Where in the attack did information cross sites? This seems like it is an embedded XSS attack in that a malicious script was entered into a profile in hopes that victims would view and execute it. However, nothing was sent across sites via the script. The vulnerability was a lack of output validation in my opinion, which is the same vulnerability that an XSS attack would exploit. I don't know how you would classify the attack... Probably "self-replicatingsession riding". Yeah that has a nice FUD-factor to it.
The term "Cross Site Scripting" was a bit poorly chosen, and is more than a little misleading. This attack _is_ a classic example of Cross Site Scripting since the user executed a script that did not come from the trusted site but came from an attacker instead. Yes, technically it may have been embedded in the site, but it was created by the attacker. I think you're following a very literal definition of what a XSS attack is, i.e. that the script actually has to come from another site - it doesn't; as long as it comes from an untrusted source, in this case the untrusted source was the initial attack embedded in the attacker's own profile. So this is really an example of a persistent, or second order Cross Site Scripting attack. http://en.wikipedia.org/wiki/Cross_site_scripting
Stephen
-----Original Message----- From: Chris Varenhorst [mailto:varenc () MIT EDU] Sent: Thursday, October 13, 2005 8:39 AM To: Akash Cc: webappsec () securityfocus com Subject: Re: myspace hackOh wow I'm wrong, I'm apparently thinking of current myspace bots which doas I described. It looks this was in fact made possible by an XSS vulnerability. Sorry On Thu, 13 Oct 2005, Chris Varenhorst wrote:This isn't hacking at all. (at least not what I'd call it)This is writing a script to go through myspace IDs (which happen to besquential) issuing friend requests to every one of them. To prevent this, now myspace limits friend requests to a certain number per day. Hope that covers it! -Chris On Thu, 13 Oct 2005, Akash wrote:Does anyone has more technical details about how 1 million accountsgot hacked in about 24 hours. This is the supposed confession of the hacker http://fast.info/myspace/ I currently studying for CEH and just finished reading about XSS. So this is of special interest. regards akash
Current thread:
- myspace hack Akash (Oct 13)
- Re: myspace hack Stephen de Vries (Oct 13)
- Re: myspace hack Chris Varenhorst (Oct 13)
- Re: myspace hack Chris Varenhorst (Oct 13)
- <Possible follow-ups>
- RE: myspace hack Griffiths, Ian (Oct 13)
- Re: myspace hack rSYN (Oct 13)
- RE: myspace hack Reynolds, Jake (Oct 14)
- Re: myspace hack Stephen de Vries (Oct 14)
- RE: myspace hack Radoslav Vasilev (Oct 14)
- RE: myspace hack Andrew Chong (Oct 14)
- Re: myspace hack Stephen de Vries (Oct 14)
- Re: myspace hack Tim Brown (Oct 14)
- Re: myspace hack bugtraq (Oct 14)
- Re: myspace hack Tom Gallagher (Oct 14)
- Re: myspace hack Disco Jonny (Oct 14)
- RE: myspace hack Jeff Robertson (Oct 14)
- RE: myspace hack Richard M. Smith (Oct 14)
- RE: myspace hack Reynolds, Jake (Oct 14)