MoD website outflanked by XSS flaws
Medic!
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Hackers have discovered cross-site scripting (XSS) vulnerabilities on the UK's Ministry of Defence website.
The security shortcomings create a means for miscreants or pranksters to present content from a website under their control in a pop-up window that appears to come from the MoD. This class of flaw is very serious on banking or ecommerce websites, because it enables the creation of more plausible phishing attacks, and is best described as embarrassing in the case of the MoD. Affected portions of the MoD's website include the search engine of the MoD contracts sub-domain and the search page for the sub-domain of Sandhurst, the prestigious Army officer training college.
The shortcomings of the MoD's website was demonstrated by a hacking crew called "Team Elite", which has also claimed responsibility for discovering similar XSS flaws on the websites of the World Health Organisation and MI5. Team Elite has notified the MoD about the vulnerabilities on its site and published its findings. Its advisory on the flaws - containing screen shots - can be found here.
Another sub-domain run by the MoD was affected by XSS flaws last year, according to XSSed, which maintains an archive of cross-site scripting bugs on websites. ®
COMMENTS
Are you serious...
I figured someone posting about this would know more about these kind of flaws..this is harmless. What you're thinking of are things like forums, blogs, etc. where the xss code is stored and echo'd everytime someone views the page. In this case you might aswell go into your browser and type javascript:alert('hack'); because this is temporary it's only echo'd to the user who types in the arbitrary code no one else.
Please next time before instilling fear into people do research on what you're showing them.
I went to the MoD site and all I got was...
What I found on the contractor's swap (popup) page:
Stephen Kring's Tommyhawkers cruise missile - Clean PVC shell, Original Estes motor(s)! Nightmares extra.
Chefton MBT - Slightly munched on right side, still little over 142.5 stone. Must pickup in Man.
Beagle Coms system - OEM, real thing; Troops don't want'em! Paypal only.
101 things to do as an Evil Overlord
No. 348756839465906: Must remember not to post "Top Secret Plans For World Domination" as a popup...
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
