IE8神秘漏洞可令用户自动发推

　　微软安全响应小组（MSRT）正在调查Internet Explorer 8中的一个神秘漏洞，这是一个已经被公开披露的神秘漏洞。

　　该漏洞可以让黑客窃取认证凭据，然后令受害者不受自己控制地发出危险的twitter信息。

　　值得注意的是，利用该漏洞的黑客相当狡猾，他们“合理”地利用了网址缩短服务来迷惑受害者，不过目前已知Opera、Firefox、Chrome和Safari都不受此漏洞影响。

以下是来源：

Internet Explorer 8 PoC: Twitter forced-tweet demo
--------------------------------------------------------------------------------
From: Chris Evans <scarybeasts () gmail com>
Date: Fri, 3 Sep 2010 15:38:52 -0700

--------------------------------------------------------------------------------

Hi,

In an attempt to get this bug fixed...

A nasty vulnerability exists in the latest Internet Explorer 8. I have been　unsuccessful in persuading the vendor to issue a fix.
The bug permits -- for example -- an arbitrary web site to force the victim　to make tweets.

(For academic research purposes only)
Harmless example: http://scary.beasts.org/misc/twitter.html

This is not weaponized. It won't do anything to your Twitter account unless　you press the button.

Notes:
- This is purely an IE bug; there is no fault on behalf of Twitter and there　is no reasonable workaround.
- Similar attacks can be mounted against other sites of interest.
- There's evidence to suggest that Microsoft has been aware of this since at　least 2008.
- This could interact unpleasantly with the trust people place in URL　shorteners.
- This probably affects earlier versions.

References:
- Public CMU academic paper: http://websec.sv.cmu.edu/css/css.pdf
- A less serious variant in all the other major browsers (long since fixed　by all of them):
http://scarybeastsecurity.blogspot.com/2009/12/generic-cross-browser-cross-domain.html

Cheers
Chris

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/