News

Cross-site scripting vulnerability may affect Earthlink, other ISPs

By Michael Hatamoto | Published April 23, 2008, 3:21 PM

Security research firm IOActive notes that several ISPs, including Earthlink, are using advertising servers to collect revenue on misspelled URLs, but alleges that in so doing, they may have mistakenly exposed users to cross-site scripting.

Dan Kaminsky, the group's director of penetration testing, reported that a bug on Earthlink servers may have allowed hackers to launch phishing attacks through the third-party Barefruit service used by several ISPs. Barefruit is a service whose stated purpose is to help ISPs catch DNS errors and redirect users appropriately. However, ISPs took advantage of that redirection by building error-catching pages that included paid advertisements. Earthlink was notoriously caught using Barefruit for this purpose in 2006.

Kaminsky, describing the provider-in-the middle (PiTMA) attacks during the Toorcon security conference in Seattle, Washington (PowerPoint slides available here), was able to exploit the bug and insert his own JavaScript code that allowed him to steal authentication cookies, create fake subdomains, and log into other users' accounts using stolen passwords. Also during his presentation, Kaminsky was able to easily add the YouTube Rick Astley music video to Facebook, PayPal, Fox News and Toorcon.

Earthlink and Barefruit announced a patch to the bug found by Kaminsky, though they chose not to discuss other security issues related to Earthlink's method of covert advertising. Earthlink said it will continue to use Barefruit in the future, but warned it will closely watch the system moving forward. It is possible there are similar vulnerabilities that put Internet users at risk when heading to mistyped URLs, even though ISPs are now aware of the problem.

Comments

View comments by with a score of at least

CT2001
Apr 24, 2008 - 12:10 PM

I've been with Earthlink for many years (I recall buying a PC magazine with two Earthlink floppy discs bundled for Windows 3.1...how long ago? 1994?), and this troubling Barefruit redirecting issue, also putting ads on the webmail of paying Earthlink members, has got me looking elsewhere. They used to be a great ISP and the best dialup available by far back in the day, but they've gotten worse and worse over the years. Cheesy and slow, and crappy software. Just talk to old Mindspring fans. Now that was a great ISP, but Earthlink killed it. Earthlink used to have great service and be a cool, friendly company. Not anymore.

Score: 0

|
Post Reply

Report: Microsoft to randomize Europe's browser screen choices

The fact that "A" is for "Apple" was apparently at the heart of browser vendor objections to Microsoft's alternative to listing IE first.

Acer eclipses Dell for #2 spot in global PC shipments, says iSuppli data

It literally does look like a 360-degree turnaround in Dell's fortunes, as the bells of bad tidings now toll solely for Dell.

Microsoft, don't hang up on Windows Mobile, but do call for help

Only a Manhattan Project can save Microsoft's phone strategy now.

See ya later, WinMo: Microsoft's mobile strategy needs a reboot

Carmi Levy | Wide Angle Zoom: Hands up if you're considering upgrading to a Windows phone for the holidays...Anybody?

Playing catch-up in 2010: Windows Mobile, BlackBerry, and Symbian

Microsoft, RIM, and Nokia are each working on improved mobile operating systems. But could these efforts add up to too little, too late?

Will Nokia's plans further alienate American consumers?

A look at Nokia's plans for the coming years does little to shine up the company's increasingly dull image.

Bing bonked by service outage Thursday, Microsoft configured the wrong server

It's always nice to have a backup, but it's even nicer to remember which one is the backup. That's the lesson Bing's admins learned yesterday evening.

Survey reveals there are more women then men, including on social networks

If you think you can market your products and services online as though you're selling car batteries in the middle of halftime, think again. And again.

Android team updates 'Donut' and 'Eclair' SDKs

The Android SDK includes components which optimize app development for each version of the mobile operating system. Today, the 1.6 and 2.0 components got updates.

The Black Screen Syndrome, or, Tech news in search of the apocalypse

Scott Fulton On Point: This is a story about something that should not have been a story, about something that at one time was a story.

Online advertising evolves away from display, toward interactive software

Marketing departments and agencies are increasingly establishing positions for "creative technologists" who can steer designers and developers toward platforms that enable direct connections with consumers.