|
eBay And Amazon Still Vulnerable
|
January 4, 2005 |
|
With the holidays over and everyone heading back to work many people are breathing a
sigh of relief. With the holiday rush over, and a new year ahead you probably give no
thought to the question of "Was my online holiday shopping done safely and securely?".
Unfortunately the answer to this question could very well be no. Despite millions and
millions of dollars being spent each and every year by big name online ecommerce outfits
a good number still remains vulnerable to security flaws. |
|
Read This Article
|
Article Read 16646 Times
|
|
When Small Mistakes Can Cause Big Problems
|
September 18, 2004 |
|
GulfTech Security Research was able to find in the past few weeks, cross site
scripting issues that existed on eBay, Amazon, Half.com, HBO, CareerBuilder,
AOL, CNN, MTV, and many others. The cross site scripting issues on these websites
could allow an attacker to take control of arbitrary accounts, or steal sensitive
info. Websites such as eBay, Amazon, and Half.com (for example) have fairly good
Security when it comes to protecting their user’s accounts, but even they are
vulnerable to data theft via these vulnerabilities. For example, it may be somewhat
useless to steal a victim’s cookie, or try and render malicious code, or force
command execution on a website with tight account security. So instead of relying
on some great technological advantage an attacker could simply attempt to take
advantage of the human element and have the victim simply give the attacker their
account information. This can be done by using the cross site scripting
vulnerabilities to temporarily deface a website. So, instead of rendering malicious
code, or trying to steal a user’s cookie, the attacker can link to an offsite
JavaScript, and have it render a login form using the vulnerable website’s own HTML
and Style Sheet so that it looks nearly identical to the legitimate login form. Of
course when a victim logs in to this form it actually just steals their login
credentials. The attacker could also use the same methods of temporarily defacing
the website to show someone a fictitious news story on a major news website. |
|
Read This Article
|
Article Read 13887 Times
|
