3 ms·

It's an example of a fairly typical XSS hole in the HTML an advertiser has provided. It just felt worth posting about because the sites involved are high profil

by kemayo 15y ago

It's an example of a fairly typical XSS hole in the HTML an advertiser has provided. It just felt worth posting about because the sites involved are high profile. Shows that even the big players don't always watch their inputs.

loopdoend 15y ago
That is a massive hole. Very nice find. I hope you notified the ad network of this before you posted it though, responsible disclosure of these things is important because this hole can now be used by anyone to do pretty much anything. The most obvious thing that comes to mind is a spammer using this to redirect traffic through a third party domain which is whitelisted.
- kemayo 15y ago
  They were a bit lacking in an obvious right person to email[1], but I did send a quick "hey there's a problem" note. I almost didn't when I saw that their main "contact us" page was a "opt in for us to email you" form, but then I found some actual email addresses rather further down. [1]: http://www.eyewonder.com/contact.php http://www.eyewonder.com/contact.php
  - GICodeWarrior 15y ago
    I just sent an email to sitesupport@, websites@ (both from whois), abuse@, noc@, webmaster@, security@ (from RFC2142). Generally you should attempt to receive a response before posting vulnerabilities though...
    - kemayo 15y ago
      Past experience dealing with ad networks about this issue has led me to believe that they really don't care. Multiple networks, multiple framebusting scripts they want you to host, all with blatant security holes that they don't want to fix after you (as a client) point them out. Or maybe it's that the people in the organization who might care are completely insulated from the channels available to people who are dealing with the network as a client. Hard to say.
ChuckMcM 15y ago
From the article "Also, don't trust your ad networks to know/care about security." This is one of those things that I wish something akin to Amazon's Silk browser would be useful. Replace the javascript with <img src=adnetwork/myid.png> and have the script run on their end which provides the pre-rendered advertisement. Yes I realize its not that simple, listening to Brandon Downey at Google explain all the ways one might mount an XSS attack was always both awe inspiring and depressing at the same time. We've seen a number of ad network issues, it seems like a common attack surface.
- rmc 15y ago
  Ah but the advertisers want dynamic ads and tracking and stuff!

by kemayo 15y ago

loopdoend 15y ago

That is a massive hole. Very nice find. I hope you notified the ad network of this before you posted it though, responsible disclosure of these things is important because this hole can now be used by anyone to do pretty much anything. The most obvious thing that comes to mind is a spammer using this to redirect traffic through a third party domain which is whitelisted.

kemayo 15y ago
They were a bit lacking in an obvious right person to email[1], but I did send a quick "hey there's a problem" note. I almost didn't when I saw that their main "contact us" page was a "opt in for us to email you" form, but then I found some actual email addresses rather further down. [1]: http://www.eyewonder.com/contact.php http://www.eyewonder.com/contact.php
- GICodeWarrior 15y ago
  I just sent an email to sitesupport@, websites@ (both from whois), abuse@, noc@, webmaster@, security@ (from RFC2142). Generally you should attempt to receive a response before posting vulnerabilities though...
  - kemayo 15y ago
    Past experience dealing with ad networks about this issue has led me to believe that they really don't care. Multiple networks, multiple framebusting scripts they want you to host, all with blatant security holes that they don't want to fix after you (as a client) point them out. Or maybe it's that the people in the organization who might care are completely insulated from the channels available to people who are dealing with the network as a client. Hard to say.

ChuckMcM 15y ago

From the article "Also, don't trust your ad networks to know/care about security." This is one of those things that I wish something akin to Amazon's Silk browser would be useful. Replace the javascript with <img src=adnetwork/myid.png> and have the script run on their end which provides the pre-rendered advertisement. Yes I realize its not that simple, listening to Brandon Downey at Google explain all the ways one might mount an XSS attack was always both awe inspiring and depressing at the same time. We've seen a number of ad network issues, it seems like a common attack surface.

rmc 15y ago
Ah but the advertisers want dynamic ads and tracking and stuff!