Re: [VulnDiscuss] RE: New Web Vulnerability - Cross-Site Tracing

On Thu, 23 Jan 2003, Richard M. Smith wrote:

> Do you know of any cases of cross-site scripting being used in the real
> world?  I looked around last fall some and couldn't find any examples
> being reported.

The problem is that XSS typically gets morphed into 'trojan horse' by the
media, if it does get reported at all.

However, when I was in Singapore, the following was described to me (by
many different security-savvy people) as being a XSS attack through email.
Supposedly the bank used session cookies with no session expiration...and
the broadband users never actually logged out of the bank app.  Enter XSS
bug stage left, cookie is stolen, and account compromised.

http://it.asia1.com.sg/newsdaily/news003_20020629.html
http://it.asia1.com.sg/newsdaily/news003_20020712.html
http://www.sensecurity.org/dbs.htm
http://www.channelnewsasia.com/stories/singaporelocalnews/view/12347/1/.html

If you read the articles, it's easy to see how well the fact that it's XSS
is not obvious; we're lead to believe it was probably open Windows shares
on a broadband connection, leading to someone uploading and running a
trojan.

Of course, perhaps it wasn't XSS, but I believe the dozen or so different
people who told me it was (or perhaps I wasn't listening correctly).

Regardless, if it was a trojan in email, it could have just as easily been
a XSS bug in email. ;)  Different exploit vector, same result.

- rfp