Forum latest

An All in one, Webmail-borne worms!
General
Written by Daniel   
Tuesday, 17 July 2007 12:22
Cross-Site, Cross-Service
Tim Wilson, Site Editor, Dark Reading

JULY 16, 2007 | An Italian researcher has found a way to spread a Webmail worm to every user in a victim's address book, no matter which client they may use.
Rosario Valotta, an independent researcher, has published a proof of concept which demonstrates that Webmail clients from multiple service providers can be exploited simultaneously via cross-site scripting vulnerabilities that they all have in common. The exploit shows that Webmail-borne worms can be propagated at rates much faster than previously thought.

Webmail worms, like many other email attacks, spread by accessing a victim's address book and replicating themselves to addresses that use the same Webmail client. Users who were in the address book, but used a different Webmail client, were previously considered safe -- until Valotta demonstrated the spread of a Webmail worm across clients provided by four different Italian Internet service providers.

The proof of concept, dubbed the "Nduja Connection," is Valotta's first worm. In an email interview, he says he developed the exploit to help stir some action by ISPs, many of which are subject to XSS vulnerabilities.

"At the beginning, I thought that the XSS [vulnerability] I found was an isolated case, but after few searches, I realized that the problem had a bigger 'scope' -- most Websites are affected by some kind of application security vulnerability," Valotta observes. "Furthermore, security people's concerns about XSS were ignored by providers -- they were sure that users' security could never be threatened by XSS.... More

Comment in the Forums 

 

See also

None found.


Hardware | Windows | Linux | Security | Mobile Devices | Gaming
Tech Business | Editorial | General News | folding@home

Forum | Download Files

Copyright ©2001 - 2012, AOA Forums.  All rights reserved.

Alliance of Overclocking Arts

Links monetized by VigLink

Don't Click Here Don't Click Here Either