Windows 7: Microsoft investigates public IE CSS XSS flaw; Twitter, Hotmail vulner

Microsoft investigates public IE CSS XSS flaw; Twitter, Hotmail vulnerable
Late last week, a security flaw in Internet Explorer 8 was publicly disclosed to the Full Disclosure mailing list. The flaw allows attackers to steal private information from online services such as web mail and Twitter, allowing attackers to, for example, delete e-mails or send tweets from their victims' accounts.

The post was made by Google employee Chris Evans. He stated that the reason for going public was to try to persuade Microsoft to fix the problem—the new flaw is a variant on an older attack, and the details of the flaw were made public in a paper authored by Carnegie Mellon students that Evans reviewed. While the other major browser vendors have made fixes to their browsers to prevent attack—Chrome 4.0.249.78, Safari 4.0.5, and most recently Firefox 3.6.7 and 3.5.11 all include protection against the flaw—Microsoft has thus far failed to update Internet Explorer to provide protection.



The attack compromises the same-origin policy. The same-origin policy is designed to prevent scripts from one domain from accessing data belonging to another domain. For example, a script from example.org should not be able to access cookies or page content from twitter.com. These attacks, where one site (controlled by the attacker) compromises the secret data of another site, are called cross-site scripting (XSS) attacks. There are many different ways that a site on one domain can embed content from another domain; images are commonly embedded in this way, as are Flash movies to deliver content from sites like YouTube.