Home page logo

webappsec logo WebApp Sec mailing list archives

Re: myspace hack (History of XSS)
From: Jeremiah Grossman <jeremiah () whitehatsec com>
Date: Fri, 14 Oct 2005 09:14:02 -0700

That sounds about right.

If I remember correctly, the term "Cross-Site Scripting" (or CSS at the time) did originate around 1996-ish. At that time the definition was very different. The time when every website was a FRAME'd page (remember?). People figured out your could automatically include content from other domains on your website using frames. Then using JavaScript you could access the content inside those windows and cross the website boundary. These issues were reported in the media as browser vulnerabilities, most notably Netscape, and the term Cross- Site Scripting was born. Maybe we'd be able to dig up the URL's. Later the acronym changed to XSS to resolve confusion with Cascading Style Sheets.

Today, the Cross-Site Scripting (XSS) definition has expanded to the point where the name make little sense. In my opinion, the MySpace attack is XSS.



Another definition URL:
http://www.webappsec.org/projects/threat/classes/cross- site_scripting.shtml

On Oct 14, 2005, at 8:35 AM, Jeff Robertson wrote:

It was called XSS before 2002. The wikipedia article that someone already
mentioned links to:


All of which are from 2000.

I remember the vulnerability now known as "stored xss" being an issue as far back as 1996-ish on web based forums, but I don't think it had any name at
that time.

Jeff Robertson
Manager of Web Application Security
Digital Insight

-----Original Message-----
From: Richard M. Smith [mailto:rms () computerbytesman com]
Sent: Friday, October 14, 2005 11:14
To: webappsec () securityfocus com
Subject: RE: myspace hack

I believe that Microsoft first came up with the cross-site
scripting name.
They wrote a paper on the subject around 2002.

"Script injection" does sound like a more descriptive and
accurate name.


-----Original Message-----
From: Jeff Robertson [mailto:Jeff.Robertson () DigitalInsight com]
Sent: Friday, October 14, 2005 10:55 AM
To: 'Reynolds, Jake'; Chris Varenhorst; Akash
Cc: webappsec () securityfocus com
Subject: RE: myspace hack

The name "XSS" does not make sense in a lot of its applications.

What "Stored XSS" and "Reflected XSS" have in common is the
injection of
script into places where script wasn't supposed to be. Having
more than one
site be involved is not the factor. What has been discussed
in this thread
seems to me like it falls under "Stored XSS".

It would make more sense if this was called "script
injection", but for some
reason the whole family was named XSS.

Who the heck names these things, anyway?

Jeff Robertson
Manager of Web Application Security
Digital Insight

-----Original Message-----
From: Reynolds, Jake [mailto:Jake.Reynolds () fishnetsecurity com]
Sent: Friday, October 14, 2005 10:30
To: Chris Varenhorst; Akash
Cc: webappsec () securityfocus com
Subject: RE: myspace hack

I wouldn't consider this an XSS attack. Where in the attack did
information cross sites? This seems like it is an embedded

XSS attack

in that a malicious script was entered into a profile in hopes that
victims would view and execute it. However, nothing was sent across
sites via the script. The vulnerability was a lack of output
validation in my opinion, which is the same vulnerability

that an XSS

attack would exploit. I don't know how you would classify the
attack... Probably "self-replicating session riding". Yeah

that has a

nice FUD-factor to it.


Senior Security

Engineer -- Consulting Services FishNet Security

Phone: 816.421.6611
Toll Free: 888.732.9406
Fax: 816.421.6677


-----Original Message-----
From: Chris Varenhorst [mailto:varenc () MIT EDU]
Sent: Thursday, October 13, 2005 8:39 AM
To: Akash
Cc: webappsec () securityfocus com
Subject: Re: myspace hack

Oh wow I'm wrong, I'm apparently thinking of current myspace bots
which do as I described.  It looks this was in fact made

possible by

an XSS vulnerability.

On Thu, 13 Oct 2005, Chris Varenhorst wrote:

This isn't hacking at all. (at least not what I'd call

it) This is

writing a script to go through myspace IDs (which

happen to be

squential) issuing friend requests to every one of them.

To prevent

this, now myspace limits friend requests to a certain

number per day.

Hope that covers it!


On Thu, 13 Oct 2005, Akash wrote:

Does anyone has more technical details about how 1

million accounts

got hacked in about 24 hours.

This is the supposed confession of the hacker

I currently studying for CEH and just finished reading

about XSS. So

this is of special interest.



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]