Feeds

MoD website outflanked by XSS flaws

Medic!

Top 5 reasons to deploy VMware with Tegile

Hackers have discovered cross-site scripting (XSS) vulnerabilities on the UK's Ministry of Defence website.

The security shortcomings create a means for miscreants or pranksters to present content from a website under their control in a pop-up window that appears to come from the MoD. This class of flaw is very serious on banking or ecommerce websites, because it enables the creation of more plausible phishing attacks, and is best described as embarrassing in the case of the MoD. Affected portions of the MoD's website include the search engine of the MoD contracts sub-domain and the search page for the sub-domain of Sandhurst, the prestigious Army officer training college.

The shortcomings of the MoD's website was demonstrated by a hacking crew called "Team Elite", which has also claimed responsibility for discovering similar XSS flaws on the websites of the World Health Organisation and MI5. Team Elite has notified the MoD about the vulnerabilities on its site and published its findings. Its advisory on the flaws - containing screen shots - can be found here.

Another sub-domain run by the MoD was affected by XSS flaws last year, according to XSSed, which maintains an archive of cross-site scripting bugs on websites. ®

Beginner's guide to SSL certificates

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.