| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <AANLkTi=HRB1DsOsVy7PM5S9dMOXh0oZt3RAkZtdiD3Mb@mail.gmail.com>
Date: Fri, 3 Sep 2010 15:38:52 -0700
From: Chris Evans <scarybeasts@...il.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Internet Explorer 8 PoC: Twitter forced-tweet demo
Hi,
In an attempt to get this bug fixed...
A nasty vulnerability exists in the latest Internet Explorer 8. I have been
unsuccessful in persuading the vendor to issue a fix.
The bug permits -- for example -- an arbitrary web site to force the victim
to make tweets.
(For academic research purposes only)
Harmless example: http://scary.beasts.org/misc/twitter.html
This is not weaponized. It won't do anything to your Twitter account unless
you press the button.
Notes:
- This is purely an IE bug; there is no fault on behalf of Twitter and there
is no reasonable workaround.
- Similar attacks can be mounted against other sites of interest.
- There's evidence to suggest that Microsoft has been aware of this since at
least 2008.
- This could interact unpleasantly with the trust people place in URL
shorteners.
- This probably affects earlier versions.
References:
- Public CMU academic paper: http://websec.sv.cmu.edu/css/css.pdf
- A less serious variant in all the other major browsers (long since fixed
by all of them):
http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html
Cheers
Chris
Content of type "text/html" skipped
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists