2.4 – Social Engineering - Cross-Site Scripting

Cross-Site Scripting (XSS)

• XSS is an abbreviation for cross-site scripting, used instead of CSS to avoid confusion with cascading style sheets.
• XSS takes information from one site and shares it with another, exploiting browser vulnerabilities.
• Keeping your browser updated is crucial due to browser vulnerabilities

Vulnerability and Code

• Code can be written to prevent XSS, even if the browser is vulnerable.
• XSS is complex and hard to identify without code knowledge; web application developers need to check their code to prevent it.
• XSS can be considered a type of malware that exploits JavaScript vulnerabilities in browsers.
• Disabling JavaScript isn't an ideal solution as it's essential for most websites.

How XSS Works

• XSS involves running a script inside a user's browser, often through a web application input like a search box.
• Attackers commonly use emails with links that run scripts to steal private info: user credentials, session IDs or other sensitive details, and send it to the attacker.
• The script runs in the browser as if from the web server, even though the attacker added malicious JavaScript.
• Attackers can gain access to a user's account using stolen session IDs or credentials.

Example Attack: Shopping Cart Checkout

• An attacker can exploit a vulnerable shopping cart checkout process on a website.
• If an attacker obtains the session ID, they can use it to access the same login session from their browser.
• JavaScript can be added to the page to retrieve the session ID.
• The attacker can collect the session ID without the user's knowledge.

Persistent (Stored) XSS Attacks

• Persistent XSS involves placing malicious code on a centralized server, like a social media site.
• Anyone visiting the page with the malicious code in a comment will run the JavaScript.
• Unlike targeted email attacks, stored XSS can affect many users who visit the compromised page and spread quickly.

Real-World Example: Subaru Car Hack

• In 2017, a security researcher, Aaron Guzman, found vulnerabilities in Subaru's web-based front end.
• Guzman found that user session tokens never expired, allowing continued access.
• Session ID info wasn't validated, letting anyone use another user's email and generated token to access their vehicle
• This flaw allowed full access to other people's vehicles, even without owning a Subaru.
• A XSS attack in email could steal a user's token, granting access via the Subaru website.
• Subaru fixed its software to prevent future exploitation if this vulnerability.

Mitigation Strategies

• Avoid clicking links in emails to prevent hidden script execution.
• Disabling JavaScript is not always practical or fully effective.
• Keep your browser and applications updated to patch security vulnerabilities.
• Developers should validate all input to applications to filter out malicious scripts.