CYBER NEWS

En XSS Bug Fundet (og Fast) i Photos.Facebook.com

facebook-stforumVi alle elsker Facebook, men gør vi ved, hvor sikkert det er? Tilsyneladende, ikke så sikker som det skal være, as disclosed by the independent security researcher Jack Whitton also known as fin1te. The UK researcher just published an unbelievable story involving an XSS bug (cross-site-scripting) and Facebook’s content delivery network.

The researcher reported the bug back in July 2015 but didn’t go public just until few days ago.

Why Are XSS Bugs Dangerous?

What is an XSS vulnerability? En XSS-drevne angreb finder sted, når ondsindede aktører gennemfører ondsindede scripts til legitime websteder. En XSS sårbarhed udnyttes, når du, for eksempel, sende en hjemmeside indhold, der indeholder indlejrede ondsindet JavaScript. Hjemmesiden vil senere omfatte koden i sit svar.

Every time a website shows any content that comes from another source (such as an uploaded file or included in a URL address), the website should filter out any suspicious characters. Keep in mind that such characters usually include brackets and < > signs. Such signs are used to denote parts of a page that should be managed as images, links, scripts, etc.

The XSS Bug in Photos.Facebook.com

What did fin1te find? The researcher found a way to create a URL on photos.facebook.com, redirected to allocate his specially crafted file from the content delivery network (CDN). Med andre ord, he succeeded in uploading a hidden script to the CDN, and retrieving it with the help of an innocently masqueraded link.

Once clicked by a user, the script would run in the browser like it was an official Facebook script. If the user is logged in, the crafted script could do practically anything the user would do – post messages, billeder, get access to private data, etc.

Having in mind how a social network works, such scripts could easily go viral, in a negative aspect. That is why an attack involving an XSS bug could be referred to as a worm-like threat. It can be deployed to spread itself automatically across any network, thus turning into a network worm or virus.

The XSS bug was fixed almost immediately after the researcher reported it to Facebook. Ikke desto mindre, he waited half a year to make it public so that Facebook security engineers have enough time to implement a better solution. He was awarded $7500.

Milena Dimitrova

Milena Dimitrova

En inspireret forfatter og indhold leder, der har været med SensorsTechForum siden begyndelsen. Fokuseret på brugernes privatliv og malware udvikling, hun tror stærkt på en verden, hvor cybersikkerhed spiller en central rolle. Hvis almindelig sund fornuft giver ingen mening, hun vil være der til at tage noter. Disse noter senere kan blive til artikler! Følg Milena @Milenyim

Flere indlæg

Følg mig:
Twitter

Efterlad en kommentar

Din e-mail-adresse vil ikke blive offentliggjort. Krævede felter er markeret *

Frist er opbrugt. Venligst genindlæse CAPTCHA.

Del på Facebook Del
Loading ...
Del på Twitter Tweet
Loading ...
Del på Google Plus Del
Loading ...
Del på Linkedin Del
Loading ...
Del på Digg Del
Del på Reddit Del
Loading ...
Del på Stumbleupon Del
Loading ...