Amazon purges account hijacking threat from site
XSS no more
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Amazon.com administrators on Tuesday closed a security vulnerability that made it possible for attackers to steal user login credentials for the highly trafficked e-commerce website.
The XSS, or cross-site scripting, bug on Amazon Wireless allowed attackers to steal the session IDs that are used to grant users access to their accounts after they enter their password. It exposed the credentials of customers who clicked on this link while logged in to the main Amazon.com page.
It was discovered by Nir Goldshlager, a researcher from security consulting company Avnet. It was purged from Amazon about 12 hours after The Register brought it to the attention of the website's security team.
"This is very bad news," web application expert Jeremiah Grossman of WhiteHat Security said of the flaw shortly before it was fixed. People who fell for the attack would likely be unaware anything was amiss "since it all takes place on Amazon's website."
XSS bugs are the most commonly found security vulnerability, Grossman added. A similar flaw was recently exploited to give malicious hackers access to a heavily fortified server operated by the security-conscious Apache Foundation. ®
COMMENTS
Build A Better...
...lock, and the thieves will build better lock picking tools.
Security is not something you do once and then walk away.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
