Intellectual Property Law

Look Ma, I'm on CIA.gov

By Ryan Singel, Kevin Poulsen, Sarah Lai Stirland, Kim Zetter, and David Kravets

In an age where JavaScript is so ubiquitous that some websites won't even load if you don't enable in your browser, cross-site scripting hacks are everywhere - letting malicious or merely mischievous hacker create links that have some very unintended consequences on websites that are not careful to keep from executing other people's code.

Most are run-of-the-mill and hardly worth writing about, but reader Harry Sintonen writes in with a vulnerability on the CIA's site that THREAT LEVEL can't resist.

For those of you who don't see it after clicking through, notice that the links lead to the CIA's site, but displays a recent THREAT LEVEL story. Here the CIA search box fails to rip out characters that will run as a script when the site tries to process the search query.

It's a pretty common error. Recently, spammers found a similar bug in Wired.com's search engine and used it to drive up their sites' placement in search engines. Dancho Danchev kindly reported it to us and it's since been fixed..

Still, I am now tempted to add the CIA to the list of media outlets I have written for. And HS's other demo link is pretty funny, as well. Sintonen has a list of other vulns he found here (.txt).

And, by the way, this little hack does not work if you are using Firefox along with the NoScript plug-in.

See Also:

• Security Guru Gives Hackers a Taste of Their Own Medicine
• Widespread, decade-old vulnerability opens gate through firewalls
• SSL Gmail Not As Safe As You Thought -- UPDATED
• MySpace's Leaked Photos More Popular Than Sweeney Todd
• HowTo Evade Turkey's YouTube Block - Updated Thursday
• Web 2.0 As A Story To Be Destroyed by Hackers
• Nasty Adobe Reader Exploit

Full post as published by Threat Level on April 14, 2008 (boomark / email).