RE: myspace hack (History of XSS)

[Jeff Robertson <Jeff.Robertson () DigitalInsight com>]

Yeah. I remember reading about the same-origin issues. They were fixed very
early, I thought.

The first time I remember seeing what we *NOW* call XSS, was in forums and
guestbooks and such. The irrestible tempation for anyone who knew javascript
was to go to these sites and post a message consisting of:

  <script>alert("I rock!");</script>

Of course more mean-spirited folks might try something like:

  <script>window.close();</script>

This was before the browser would prompt the user about allowing close()
method to execute. That post would immediately close the browsers of
everyone who tried to access the page, effectively causing denial of
service.

Very soon afterwards, the developers of these web applications starting
trying all kinds of tricks to allow "safe" HTML (like <b> and <i>) to be
used while banning the evil <script>.

As the myspace business shows, this war is still being escalated like some
kind of Itchy and Scratchy cartoon.

Jeff Robertson
Manager of Web Application Security
Digital Insight


> -----Original Message-----
> From: Jeremiah Grossman [mailto:jeremiah () whitehatsec com]
> Sent: Friday, October 14, 2005 12:14
> To: Jeff Robertson
> Cc: 'Richard M. Smith'; webappsec () securityfocus com
> Subject: Re: myspace hack (History of XSS)
>
>
> That sounds about right.
>
> If I remember correctly, the term "Cross-Site Scripting" (or CSS at  
> the time) did originate around 1996-ish. At that time the definition  
> was very different. The time when every website was a FRAME'd page  
> (remember?). People figured out your could automatically include  
> content from other domains on your website using frames. Then using  
> JavaScript you could access the content inside those windows and  
> cross the website boundary. These issues were reported in the media  
> as browser vulnerabilities, most notably Netscape, and the 
> term Cross- 
> Site Scripting was born. Maybe we'd be able to dig up the URL's.  
> Later the acronym changed to XSS to resolve confusion with Cascading  
> Style Sheets.
>
> Today, the Cross-Site Scripting (XSS) definition has expanded to the  
> point where the name make little sense. In my opinion, the MySpace  
> attack is XSS.
>
>
> Regards,
>
> Jeremiah-
>
> Another definition URL:
> http://www.webappsec.org/projects/threat/classes/cross- 
> site_scripting.shtml
>
>
>
> On Oct 14, 2005, at 8:35 AM, Jeff Robertson wrote:
>
> > It was called XSS before 2002. The wikipedia article that someone  
> > already
> > mentioned links to:
> >
> >     http://www.cert.org/advisories/CA-2000-02.html
> >     http://webmonkey.wired.com/webmonkey/00/18/index3a.html
> >     http://httpd.apache.org/info/css-security/
> >
> > All of which are from 2000.
> >
> > I remember the vulnerability now known as "stored xss" being an  
> > issue as far
> > back as 1996-ish on web based forums, but I don't think it had any  
> > name at
> > that time.
> >
> >
> > Jeff Robertson
> > Manager of Web Application Security
> > Digital Insight
> >
> >
> >
> > > -----Original Message-----
> > > From: Richard M. Smith [mailto:rms () computerbytesman com]
> > > Sent: Friday, October 14, 2005 11:14
> > > To: webappsec () securityfocus com
> > > Subject: RE: myspace hack
> > >
> > >
> > > I believe that Microsoft first came up with the cross-site
> > > scripting name.
> > > They wrote a paper on the subject around 2002.
> > >
> > > "Script injection" does sound like a more descriptive and
> > > accurate name.
> > >
> > > Richard
> > >
> > > -----Original Message-----
> > > From: Jeff Robertson [mailto:Jeff.Robertson () DigitalInsight com]
> > > Sent: Friday, October 14, 2005 10:55 AM
> > > To: 'Reynolds, Jake'; Chris Varenhorst; Akash
> > > Cc: webappsec () securityfocus com
> > > Subject: RE: myspace hack
> > >
> > > The name "XSS" does not make sense in a lot of its applications.
> > >
> > > What "Stored XSS" and "Reflected XSS" have in common is the
> > > injection of
> > > script into places where script wasn't supposed to be. Having
> > > more than one
> > > site be involved is not the factor. What has been discussed
> > > in this thread
> > > seems to me like it falls under "Stored XSS".
> > >
> > > It would make more sense if this was called "script
> > > injection", but for some
> > > reason the whole family was named XSS.
> > >
> > > Who the heck names these things, anyway?
> > >
> > >
> > > Jeff Robertson
> > > Manager of Web Application Security
> > > Digital Insight
> > >
> > >
> > >
> > > > -----Original Message-----
> > > > From: Reynolds, Jake [mailto:Jake.Reynolds () fishnetsecurity com]
> > > > Sent: Friday, October 14, 2005 10:30
> > > > To: Chris Varenhorst; Akash
> > > > Cc: webappsec () securityfocus com
> > > > Subject: RE: myspace hack
> > > >
> > > >
> > > > I wouldn't consider this an XSS attack. Where in the attack did
> > > > information cross sites? This seems like it is an embedded
> > > XSS attack
> > >
> > > > in that a malicious script was entered into a profile in 
> hopes that
> > > > victims would view and execute it. However, nothing was 
> sent across
> > > > sites via the script. The vulnerability was a lack of output
> > > > validation in my opinion, which is the same vulnerability
> > > that an XSS
> > >
> > > > attack would exploit. I don't know how you would classify the
> > > > attack... Probably "self-replicating session riding". Yeah
> > > that has a
> > >
> > > > nice FUD-factor to it.
> > > >
> > > >
> > > > Jake Reynolds, CCIE, CCSP, MCSE, CCSA, JNCIA-FWV, CWNA
> > > Senior Security
> > >
> > > > Engineer -- Consulting Services FishNet Security
> > > >
> > > > Phone: 816.421.6611
> > > > Toll Free: 888.732.9406
> > > > Fax: 816.421.6677
> > > >
> > > > http://www.fishnetsecurity.com
> > > >
> > > > -----Original Message-----
> > > > From: Chris Varenhorst [mailto:varenc () MIT EDU]
> > > > Sent: Thursday, October 13, 2005 8:39 AM
> > > > To: Akash
> > > > Cc: webappsec () securityfocus com
> > > > Subject: Re: myspace hack
> > > >
> > > > Oh wow I'm wrong, I'm apparently thinking of current myspace bots
> > > > which do as I described.  It looks this was in fact made
> > > possible by
> > >
> > > > an XSS vulnerability.
> > > > Sorry
> > > >
> > > > On Thu, 13 Oct 2005, Chris Varenhorst wrote:
> > > >
> > > >
> > > > > This isn't hacking at all. (at least not what I'd call
> > > it) This is
> > >
> > > > > writing a script to go through myspace IDs (which
> > > > happen to be
> > > >
> > > > > squential) issuing friend requests to every one of them.
> > > To prevent
> > >
> > > > > this, now myspace limits friend requests to a certain
> > > > number per day.
> > > >
> > > > > Hope that covers it!
> > > > >
> > > > > -Chris
> > > > >
> > > > > On Thu, 13 Oct 2005, Akash wrote:
> > > > >
> > > > >
> > > > > > Does anyone has more technical details about how 1
> > > > million accounts
> > > >
> > > > > got hacked in about 24 hours.
> > > > >
> > > > > This is the supposed confession of the hacker
> > > > > http://fast.info/myspace/
> > > > >
> > > > > I currently studying for CEH and just finished reading
> > > about XSS. So
> > >
> > > > > this is of special interest.
> > > > >
> > > > > regards
> > > > >
> > > > > akash