headers
Chris Evans | 4 Sep 00:38
Picon

Internet Explorer 8 PoC: Twitter forced-tweet demo

Hi,


In an attempt to get this bug fixed...

A nasty vulnerability exists in the latest Internet Explorer 8. I have been unsuccessful in persuading the vendor to issue a fix.
The bug permits -- for example -- an arbitrary web site to force the victim to make tweets.

(For academic research purposes only)

This is not weaponized. It won't do anything to your Twitter account unless you press the button.

Notes:
- This is purely an IE bug; there is no fault on behalf of Twitter and there is no reasonable workaround.
- Similar attacks can be mounted against other sites of interest.
- There's evidence to suggest that Microsoft has been aware of this since at least 2008.
- This could interact unpleasantly with the trust people place in URL shorteners.
- This probably affects earlier versions.

References:
- Public CMU academic paper: http://websec.sv.cmu.edu/css/css.pdf
- A less serious variant in all the other major browsers (long since fixed by all of them): http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html


Cheers
Chris
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Permalink | Reply |

Gmane