stopthehacker.com » XSS http://www.stopthehacker.com Jaal, LLC Wed, 21 Jul 2010 22:21:37 +0000 http://wordpress.org/?v=2.9.2 en hourly 1 Youtube Hit with HTML Injection Attack http://www.stopthehacker.com/2010/07/04/youtube-hit-by-html-injection/ http://www.stopthehacker.com/2010/07/04/youtube-hit-by-html-injection/#comments Sun, 04 Jul 2010 18:00:20 +0000 anirban http://www.stopthehacker.com/?p=1912 YouTube is reported to have been hit by hackers. They have exploited a loophole in the way YouTube lets users post comments. More information can be found in the Google Support Forum and on Slashdot.

Analysis
It seems that when someone places a piece of JavaScript in the comment section, beginning with the <script> tag, YouTube’s comment sanitization policy correctly escapes the <script> tag itself. Unfortunately, the data which follows this tag is not removed, but is displayed on the screen. This allows a clever hacker to inject HTML directly into the page, modifying the page itself and allowing all types of security issues.

This incident highlights the impact of security issues like Cross Site Scripting (XSS). These vulnerabilities should not be treated lightly, since a Web Application Filter (WAF) cannot protect you from new attacks like this one. WAFs can only protect you from what they already know.

About stopthehacker.com
At stopthehacker.com, we work hard to help you combat attacks by malicious hackers. If you would like to work with us, please drop us an email. You can also visit our services page to find out how we can help you. In fact, you can even sign up for our Free Blacklist Monitoring service!

]]> http://www.stopthehacker.com/2010/07/04/youtube-hit-by-html-injection/feed/ 0 Top Banks Suffering from Multiple Vulnerabilities http://www.stopthehacker.com/2009/11/25/top-banks-suffering-from-multiple-vulnerabilities/ http://www.stopthehacker.com/2009/11/25/top-banks-suffering-from-multiple-vulnerabilities/#comments Wed, 25 Nov 2009 17:15:27 +0000 anirban http://www.stopthehacker.com/?p=633 Solid financial institutions are the cornerstone of any successful economy. These institutions need to maintain the highest levels of security to protect sensitive customer data from becoming prey to malicious interests. Given the fact that these giants of industry have emergency response and security teams and that they spend hundreds of thousands of dollars a year on everything from general IT infrastructure to buying a plethora of security products. It is surprising to see that these top banks and financial institutions are not as locked down and airtight as one should expect.

We at StopTheHacker.com have conducted a study to ascertain if these top financial institutions are really secure or not. The findings, including a graphical summary, are also available in a PDF report attached at the end of this article.

Security Level of Top US Financial Institutions in 2009
Security Level of Top US Financial Institutions in 2009

The results were astonishing: 13 out of 14 websites had at least one critical vulnerability. In more detail, we highlight some key results below:

  1. On average, there are 1.5 critical security issues in each financial institution
  2. On average, there are 1.2 important security issues in each financial institution
  3. On average, there are 7.9 general security issues in each financial institution
  4. The highest company valuation in total assets does not correlate to the highest security
  5. The financial institution in our set with the least valuation had zero critical security holes

The identified vulnerabilities are very serious: critical security issues/holes are widely seen as major security concerns by security experts, and security standards.

The most prevalent vulnerability among all of those discovered, allows a hacker to spawn what is known as a shell, more commonly known as the command-prompt, and thereby remotely executing harmful commands on the web server. Other vulnerabilities range from major Cross Site Scripting (XSS) vulnerabilities, which can enable hacker to steal credentials of website visitors, to a plethora of concerns with various software installations used on these systems.

For more information, please feel free to contact us.

]]> http://www.stopthehacker.com/2009/11/25/top-banks-suffering-from-multiple-vulnerabilities/feed/ 0