2 ms·

Where are you getting that the takeaway was an XSS attack? There's a whole host of things wrong that the researcher finds — it almost reads like a how-to of bad

Where are you getting that the takeaway was an XSS attack? There's a whole host of things wrong that the researcher finds — it almost reads like a how-to of bad security. When you say: > However, since the security researcher appears to specialize most in XSS that wound up in the spotlight. It seems like you haven't read the original report. The researcher does NOT specialize in XSS (can one?), and is even lent a hand at the XSS portion. Here, read the original: https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/ https://scotthelme.co.uk/nomx-the-worlds-most-secure-communi...

j_s 10y ago
I agree a number of things wrong were listed. The one concrete attack demonstrated in the post (the one author put the effort into demonstrating), and thus directly addressed in the response (the takeway chosen by the vendor), was an example XSS [edit:CSRF] attack. Scott Helme has released a pair of tools focused on making sure websites anti-XSS/security headers are correct. (https://securityheaders.io/ https://securityheaders.io/ https://report-uri.io/ https://report-uri.io/ ) The bulk of his public messaging prior to this gigantic luck surface area boost could be categorised as XSS-related (website security headers). I was suprised that he needed help but good on him for being honest. I am sure this entire process has been a learning experience for Scott and will be a tremendous positive for him in his future endeavors. I remain curious how the BBC chose him; I'd guess he is one of the most polished/presentable security guys in the UK when it comes to network protocols. Edit: I need to clarify my terminology; when I say XSS above I basically mean everything under the "Web app testing" portion of the original article. (So basically s/XSS/web app testing/ please. In fact it is CSRF that is demonstrated, in my mind they've wound up classified as similar enough to get the idea across.) The security researcher chose to dive deepest into the vulnerabilities that most benefitted his side projects - which makes perfect sense! Is remote root possible with all that old software on an RPi? Feels possible to me.
- deleted 10y ago
  [deleted]

j_s 10y ago

I agree a number of things wrong were listed. The one concrete attack demonstrated in the post (the one author put the effort into demonstrating), and thus directly addressed in the response (the takeway chosen by the vendor), was an example XSS [edit:CSRF] attack. Scott Helme has released a pair of tools focused on making sure websites anti-XSS/security headers are correct. (https://securityheaders.io/ https://securityheaders.io/ https://report-uri.io/ https://report-uri.io/ ) The bulk of his public messaging prior to this gigantic luck surface area boost could be categorised as XSS-related (website security headers). I was suprised that he needed help but good on him for being honest. I am sure this entire process has been a learning experience for Scott and will be a tremendous positive for him in his future endeavors. I remain curious how the BBC chose him; I'd guess he is one of the most polished/presentable security guys in the UK when it comes to network protocols. Edit: I need to clarify my terminology; when I say XSS above I basically mean everything under the "Web app testing" portion of the original article. (So basically s/XSS/web app testing/ please. In fact it is CSRF that is demonstrated, in my mind they've wound up classified as similar enough to get the idea across.) The security researcher chose to dive deepest into the vulnerabilities that most benefitted his side projects - which makes perfect sense! Is remote root possible with all that old software on an RPi? Feels possible to me.

deleted 10y ago
[deleted]