Preventing the sausage attack UPDATED

[ciphergoth]

Update: note for new readers

I probably can't answer your questions about the attack. If bad things have happened to your journal, as a result of this attack or otherwise, please file a support requestIf you got bitten by a new attack on LJ that's recently become popular, and someone directed you here for more information, I'm sorry but you've

Comments

[ashley_y]

Can this attack currently be used against other LJ submission forms? For instance, could it be used to add a friend, or change user info, or something?

[penguinny]

Yes, it can. I saw this done (not sure, if you want to see the exact link - it is in Russian).

Re: Oh jeez.

[vardissakheli]

Not to give anybody any ideas, but it just occurred to me that a malicious script using this technique could open a livejournal page (or your credit card statement, or what have you) in another frame, read the contents of that page, and submit it in a form back to another host. Bye-bye private information.

Re: Oh jeez.

[owdbetts]

[...] a malicious script using this technique could open a livejournal page (or your credit card statement, or what have you) in another frame, read the contents of that page [...]

How would it read the contents of the page? It would be in a different domain, so wouldn't cross-domain scripting restrictions prevent it?

-roy

Re: Oh jeez.

[ciphergoth]

How bad are things with IE? I use Firefox, perhaps unsurprisingly.

Re: Oh jeez.

[madscience]

Pretty bad. Two days ago, another bug was publicized that allows a malicious site to install adware without your consent.

I use Firefox also... when I use Windows at all.

Re: Whew.

[vardissakheli]

Noncompliant clients notwithstanding, it's good to hear my understanding of what a script could have access to was overly broad.

Re: Whew.

[owdbetts]

Hey, that was a question, not a statement... Please don't take my word on this; I'm no expert...

Re: Yes.

[m_leprae]

I've been checking out the code for one attack that adds two friends and another that posts something to your journal and they are both very simple Javascripts. Changing user info would be a little bit harder.