MoD website outflanked by XSS flaws
Hackers have discovered cross-site scripting (XSS) vulnerabilities on the UK's Ministry of Defence website.
The security shortcomings create a means for miscreants or pranksters to present content from a website under their control in a pop-up window that appears to come from the MoD. This class of flaw is very serious on banking or ecommerce websites, because it enables the creation of more plausible phishing attacks, and is best described as embarrassing in the case of the MoD. Affected portions of the MoD's website include the search engine of the MoD contracts sub-domain and the search page for the sub-domain of Sandhurst, the prestigious Army officer training college.
The shortcomings of the MoD's website was demonstrated by a hacking crew called "Team Elite", which has also claimed responsibility for discovering similar XSS flaws on the websites of the World Health Organisation and MI5. Team Elite has notified the MoD about the vulnerabilities on its site and published its findings. Its advisory on the flaws - containing screen shots - can be found here.
Another sub-domain run by the MoD was affected by XSS flaws last year, according to XSSed, which maintains an archive of cross-site scripting bugs on websites. ®
Are you serious...
Please next time before instilling fear into people do research on what you're showing them.
I went to the MoD site and all I got was...
What I found on the contractor's swap (popup) page:
Stephen Kring's Tommyhawkers cruise missile - Clean PVC shell, Original Estes motor(s)! Nightmares extra.
Chefton MBT - Slightly munched on right side, still little over 142.5 stone. Must pickup in Man.
Beagle Coms system - OEM, real thing; Troops don't want'em! Paypal only.
101 things to do as an Evil Overlord
No. 348756839465906: Must remember not to post "Top Secret Plans For World Domination" as a popup...