FBI, CIA and NSA websites susceptible to XSS attacks.

Popular xss archive website xssed.com is reporting that government websites like FBI.gov, CIA.gov and NSA.gov are susceptible to XSS attacks found by independent researchers. Cross site scripting attacks are not new and have been causing damage since 2007, numerous trainings, presentations and books have been in market since its time of discovery but this has still been around like the SQL Injection bug and hundreds and thousands of websites are still susceptible to these sorts of attacks. Vulnerabilities of these kinds have been exploited to craft powerful phishing attacks and browser exploits. Impersonation of a legitimate website to run malicious code is one of the most effective attacks other then stealing cookies and running exploits using JavaScript with this sort of vulnerabilities. There are a host of other high profile websites that are affected by cross site scripting vulnerabilities including nasa.gov, walmart.com, bestbuy.com, cnet.com and many others. The fact the headline of this blog reads the name of government agencies is that people trust them the most and their websites are vulnerable to such common flaws. Being a security researcher I do understand that pretty much no piece of code is completely secure but the time it takes to patch such security holes should be considered as a measuring point of the seriousness of security agencies. The flaw was reported on 9th January regarding the FBI.gov xss flaw but it is still not patched (22nd January) which shows that either they do not know about the flaw or they are not very serious in patching such issues. Whatever the case may be this post is to alert the users to be cautious as legitimate domains on your browser Navigation Toolbar may end up downloading malicious software on your computer. A precaution that you guys can take is installing NoScript on your firefox browsers which pretty much all Security Professionals do use nowadays while for IE users I suggest changing your browser to Mozilla Firefox.

MD5 Practically Attacked

Although MD5 was theoretically cracked in 2004 by Chinese professor Wang Xiaoyun its practical attack scenario was not shown to the world which was mainly in my opinion due to the complexity of the method and ongoing research to minimize processing and computational power required and therefore detecting collision was not thought a practical approach. MD5 has already been abandoned by the more security savvy organization as their preferred mean of calculating hashes and digitally signing them.

In 2008 researchers from different parts of world gathered again knowing that enough research has been done to practically present the threat to those still using this weak algorithm and worked on finding collision - different messages having same MD5 hash - on MD5 signed SSL certificates and finally succeeded by the end of the year 2008 to create a fake CA certificate issuer and prove the practical implementation of the attack. The irony of the situation is that despite of the fact that MD5 has been proven to contain weakness in its hashing mechanisms many renowned Root CA's still use it.

The researchers disclosed their work at the 25C3 conference in Berlin on the 30th of December by creating a fake ssl certificate signed by RapidSSL which the researchers thought was the weakest of all. VeriSign, the issuers of RapidSSL certificates stopped using MD5 as their checksum algorithm for RapidSSL once the vulnerability was announced

More details can be found on the links mentioned below. 25C3 has also released the videos of the presentation on their website.

• Detailed explanation
• Slides from the 25c3 presentation
• Demo site (set your system date to August 2004 before clicking)

Although the private key of this was not released due to the danger of being misused by phishers the method itself was elaborated to a point that this could be done in a lesser amount of time.

Microsoft URL Redirection

It seems like microsoft is having a bad year end to 2008 as the host of security vulnerabilities being published not only in its products but also on their website. The following is one more to the pile of security issues faced by the company these days. Although it is a simple url redirect but the purpose it can be used and is being used is really dangerous mainly because of the domain name itself.

The Url redirection bug would basically redirect users clicking on the unsuspected URL as it has the familiar microsoft dot com domain name. For those of us using NOSCRIPT with firefox normally allow microsoft as the trusted source as it hinders with the browsing of the web contents on thier website.

Proof Of Concept

http://www.microsoft.com/ie/ie40/download/?//certstation.com


Let us see how quick Microsoft fixes this vulnerability.

Update: The vulnerability has been patched my Microsoft, the reacted faster then I expected way to go.