UNIVERSAL XSS BUG WITH SAME ORIGIN POLICY BYPASS
The vulnerability is known equally a Universal Cross Site Scripting (XSS) flaw. It allows attackers to bypass the Same-Origin Policy, a key browser safety mechanism, inward society to launch highly credible phishing attacks or hijack users’ accounts on whatever website.
The Same Origin Policy is i of the guiding principles that essay to protect users’ browsing experience. SOP genuinely prevents i site from accessing or modifying the browser properties, such equally cookies, location, reply etc, past times whatever other site, ensuring that no third-party tin inject code without the ascendance of the possessor of the website.
DEMONSTRATION
Recently, a proof-of-concept exploit published past times a group, known equally Deusen, shows how websites tin violate SOP dominion when someone uses supported versions of Internet Explorer running the latest patches to catch maliciously crafted pages.
In society to demonstrate the attack, the grouping exploits the vulnerability violating the same root policy on the Daily Mail's website, in addition to injects the words "Hacked past times Deusen" on the website of the Daily Mail, which way other HTML in addition to Javascript code tin too hold upward injected.
The exploit code appears to role iframes to tamper amongst IE's back upward of the SOP.
EVEN MORE WORSE SCENARIO
Instead of dailymail.co.uk, a cyber criminal could role a bank’s website in addition to thus inject a rogue shape bespeak the user for someone fiscal information.
Once the attacker's code bypasses the SOP in addition to is injected, the code has access to session cookies, in addition to in i lawsuit inward possession of the cookie, an aggressor could access sensitive information unremarkably restricted to the target website, including those amongst credit carte data, browsing histories, in addition to other confidential data.
ATTACK WORKS ON HTTPS
According to Joey Fowler, a senior safety engineer at Tumblr, the laid on too industrial plant if the targeted site uses encrypted HTTPS protocol for secure communication.
However, the websites tin protect themselves from existence targeted through this põrnikas past times using a safety header called X-Frame-Options amongst the "deny" or "same-origin" values, which prevents other sites from loading them inward iframes, Folwer noted inward a mailing list thread.
MICROSOFT WORKING ON PATCH
Microsoft is working on a laid upward for the vulnerability, which industrial plant successfully on its Internet Explorer xi running on both Windows vii in addition to Windows 8.1 operating systems.
In a statement, Microsoft said it is "not aware of this vulnerability existence actively exploited in addition to are working on a safety update." The society too encourages customers "to encourage customers to avoid opening links from untrusted sources in addition to visiting untrusted sites, in addition to to log out when leaving sites to aid protect their information."
