Archive for December 25th, 2007

Looks like 2007 improved XSS awareness in the "mainstream" media outlets too.
The Register recently published a report about the Orkut XSS worm. It's not the first time, here's a list of XSS worms and some already hit The Register's columns, but the level of understanding is visibly getting better. This is clearly good, because XSS worms are becoming more and more common. While at this moment we can mainly see goliardic demonstrations, like this nice hi5.com Xmas gift by my friend Sirdarckcat, we should all be worried of how easy and quick to find and exploit this kind of web application flaws is, and ready for the real scams that are unavoidably coming (like this), thanks to the growing importance of so called "Web 2.0 social networks" and other web services in our private and business lives.

The Register has also "discovered" Flash-based XSS, something that is surely old news in our circles: as you may remember, Sirdarkcat's attack on RSnake was based on that.

The good news is that you, dear NoScript user, are already immune from both the aforementioned XSS worms, which are based on cross-site XBL (something which is also mitigated by Firefox 3) and more generally on 3rd party script inclusion.
Even better, you're also protected against Flash-based XSS, included RSnake's kind, now in NoScript default configuration: latest NoScript, in facts, won't run Flash applets (and other plugins) even if hosted on trusted sites, when they're embedded or linked from an untrusted site. In other words, it prevents browser plugins from being exploited for XSS in its very definition.

java&
#x73;cript:
\u0061\u006c\u0065\u0072\u0074\u0028\u0022
\u0048\u0061\u0070\u0070\u0079 " + 0x07D8)

Bad Behavior has blocked 2239 access attempts in the last 7 days.