Ethical hackers have discovered potentially serious vulnerabilities on the websites of the two principal candidates in today's London Mayoral election. Both Boris Johnson’s and Ken Livingstone's campaign websites suffer from ‘cross-scripting’ (XSS) vulnerabilities that make it possible for hackers to redirect users to their …
Does this really matter...
...and does any Londoner of sound mind give a flying....duck....what any website says about the candidates !!
This is an equal opportunity sneer !!
A quick play with google image search....
and you can make your own fun link:
(don't worry, it's safe)
Very very poor scripting
You don't even need an iframe you can directly insert an img tag or even a script tag.
Simon's joke here with an img tag is much b=more transparent
Make trivial with it...
This really isn't a trivial matter though - I mean some useless web development cretin actually got paid to make these sites and didn't think to sanitise the incoming data from the URI.
The IT industry really does make me spit blood sometimes; if architectural engineering was like software engineering we'd never have been able to get anything taller than a bungalow standing.
Web developers seem to be worse than the rest.
Yes, I am a web developer (LAMP with the 'P' being predominantly PHP) and some of the code I've seen makes me just stare in disbelief at the screen - how the hell people can sleep at night after foisting that shit on someone is beyond me. Look at PHP written by ASP "developers" and you'll want to cry.
[anonymous because slagging off the IT industry here, of all places, seems unwise]
In their (limited) defence
It appears that they've removed any html being posted, it's still (at time of posting) possible to do the following though.
Now fixed on that page
But not everywhere!
Spotted and blocked by NoScript. It's a clever little tool to be sure.
It matters because the trick allows you to do pretty much anything you like, under the guise of being a legitimate site. See comments about drive-by malware downloads, etc.
Also, having a silly posting 'shtick' wasn't cool when amanfrommars did it either, though at least your effort is parseable.
Re: Limited defence
I'd agree if they actually applied the same logic elsewhere.
I take it someone
has hacked Boris Johnson's site to include that picture of him looking gormless at the top.
It's a regular feast of political choices there folks
- Leaked screenshots show next Windows kernel to be a perfect 10
- Amazon warming up 'cheapo web video' cannon to SINK Netflix
- Something for the Weekend, Sir? I need a password to BRAKE? What? No! STOP! Aaaargh!
- Episode 13 BOFH: WHERE did this 'fax-enabled' printer UPGRADE come from?
- Vulture at the Wheel Ford's B-Max: Fiesta-based runaround that goes THUNK