This blog is dedicated to revealing and destroy all forms of Malware; SPAM, VIRUS, Adware, Spyware.
|
Copyright 2005 Randy Charles Morin
Part of the KBCafe blog network
|
|
Copyright 2005 Randy Charles Morin
Part of the KBCafe blog network
|
Joris Evers: Reading blogs via popular RSS or Atom feeds may expose computer users to hacker attacks, a security expert warns.
http://news.zdnet.com/2100-1009_22-6102171.html?tag=nl.e589
Randy: OK, this seems a little naive. Javascript in RSS shouldn't create any more vulnerabilities than Javascript in HTML. Sounds like a lot of fear mongering. In particular, this security expert mentions Bloglines as a particularly vulnerable RSS reader. Since Bloglines runs in a browser, I cannot see how this present any more vulnerabilities than having visited the malicious website via a Web browser in the first place. In addition, the security expert says "some reader software on Windows systems uses Internet Explorer to display feed content, but doesn't use basic security settings that isolate the content". I'm not gonna pretend to be an IE security expert, but can anyone confirm that reading a feed via the Internet Explorer ActiveX control presents any more risk than reading the equivalent HTML in IE?
Thanks to Scott Kingery for the play tag with me link.
| Top Articles | |
|---|---|
--SterlingCamden
The major additional risk - as I understand it - is that by creating a disk file and displaying it as a web page using the IE ActiveX control means that the page is executed in the local zone and not the remote zone opening up possibilities that do not exist in normal web pages.
Microsoft offers no way to use a different zone - unless anyone knows otherwise - so Agg authors either ignore the problem or try to eliminate potential attacks. That's why some of your posts that contain script tags do not appear as you intended in my and some other Aggs.
Fortunately the issue is not as bad as it is for the web in general because we can easily identify the author of most posts - and we know them to be benign. The risk increases with syndicated feeds, however, so I try to avoid them.
Andy Henderson