A new game of show and tell...sigh

[Daniel ~]

Written by Daniel
Thursday, 21 September 2006
Hackers Reveal Vulnerable Websites
Dark Reading

SEPTEMBER 21, 2006 | Hackers on a popular hacking message board have begun posting cross-site scripting (XSS) vulnerabilities they've found on public Websites, including those of Dell, HP, MySpace, and Photobucket, as well as security companies F5 and Acunetix.

"I think they're just looking on Website after Website and finding holes and posting to the message board," says Jeremiah Grossman, CTO for White Hat Security, who has been watching a heavy volume of XSS vulnerability posts on the "Sla.ckers" message board in the past few days. Grossman says it's unusual to see such a volume of vulnerabilities posted so publicly, plus these are "real, live Websites," he notes.

They're posting proof-of-concept code that shows how to exploit the XSS vulnerabilities, but so far there's been no sign of anything malicious, Grossman says. XSS has now surpassed buffer overflow as the number one weakness in software that attackers are exploiting. (See Cross-Site Scripting: Attackers' New Favorite Flaw.)

Front Page