bugtraq - Re: XSIO - Cross Site Image Overlaying

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 10 Sep 2007 16:01:27 -0500
From: "Tod Beardsley" <todb@...nb-security.net>
To: sven.vetsch@...enchant.ch
Cc: bugtraq@...urityfocus.com
Subject: Re: XSIO - Cross Site Image Overlaying

On 9/10/07, Sven Vetsch / Disenchant <sven.vetsch@...enchant.ch> wrote:

> I wasn't able to find something written about [cross site image overlay]

FYI, this was discussed as a "Trojaned Navigation Menu" attack,
detailed on the Month of Myspace Bugs page back in April (and November
of 2006).

http://momby.livejournal.com/4250.html

Just for some historical perspective and existing research on the subject.

If the attacker has control of element positioning, he has control
over all the link targets in a document.

-- 
todb@...nb-security.net | ICQ: 335082155 | Note: Due to Google's
privacy policy <http://tinyurl.com/5xbtl> and the United States'
policy on electronic surveillance <http://tinyurl.com/muuyl>,
please do not IM/e-mail me anything you wish to remain secret.