Feeds

YouTube vuln pwns Justin Bieber fans

Shock site redirect in XSS chaos

Reducing the cost and complexity of web vulnerability management

Hackers and pranksters began exploiting a newly discovered scripting flaw on YouTube on Sunday, provoking rumours that a virus was spreading on the site.

The cross-site scripting flaw (XSS) on the video-sharing website created a means for hackers to post JavaScript code in the comments sections of videos. The flaw meant that this JavaScript code was run on the machines of surfers viewing the same video clip.

Predictable enough, pranksters at 4Chan have begun using the vulnerability to redirect surfers looking for Justin Bieber video clips to goatse or false reports that the irksomely clean-cut Canadian singer had died in a car crash. Denizens of 4Chan are separately trying to rig an online poll to encourage Beiber to play North Korea in an upcoming tour.

In other cases the flaw has become the fodder of comment spam.

Google iced the problem hours after it first appeared, techie-buzz.com reports.

"We took swift action to fix a cross-site scripting (XSS) vulnerability on youtube.com that was discovered several hours ago," said Google. "Comments were temporarily hidden by default within an hour, and we released a complete fix for the issue in about two hours. We’re continuing to study the vulnerability to help prevent similar issues in the future."

The appearance of the vulnerability sparked rumours on Twitter and elsewhere that a virus was spreading across YouTube. A blog post by Chris Boyd of Sunbelt - containing screenshots - charts the genesis of this rumour, which is just the sort of thing that's likely be used in new anti-virus (scareware) scams.

Security watchers at the Internet Storm Centre note that the vulnerability on YouTube might potentially have been used for all manner of hacking attacks, including password stealing scams.

"They [hackers] could steal your YouTube cookies, which probably doesn't mean much to them, but they could also post various JavaScript code that will execute in your browser, in the context of YouTube," an ISC handler writes. "I've seen nasty XSS attacks that are used to fake whole login screens and we know how many people use [the] same passwords for multiple accounts." ®

How to simplify SSL certificate management

More from The Register

next story
'We're having panic attacks' ... Sony staff and families now threatened in emails
Join us or else say messages purportedly from GOP hackers
The internet is less free than last year. Thanks a bunch, Snowden
Running around, warning everyone the NSA is spying on us all. What is he like?
Google kills CAPTCHAs: Are we human or are we spammer?
Do you make up these questions, Mr Wonka?
Author fined $500k in first US spyware conviction
100,000 creeps buy mobe-watching wares
Nothing illegal to see here: Tribunal says TEMPORA spying is OK
Rules mass surveillance is legal, in principle at least
Sony Pictures struggles as staff details, salaries and films leaked
Fury and Annie now doing the rounds - along with staff's privates
Stupid humans and their EXPENSIVE DATA BREACHES
Non-human cockups only account for 7% of leaks
Plusnet customers SWAMPED by spam but BT-owned ISP dismisses data breach claims
Refuses to notify watchdog despite subscribers' fears
Pay with your credit card at station kiosk? 'Dare Devil' is targeting YOU
Please collect your ticket and change (& ta for the card data)
prev story

Whitepapers

Four customers who never have to replace their PCs again
Reallocate your budget to deliver employee mobility paired with IT management efficiency and corporate security.
Manage security in real time
How security information and event management (SIEM) can work, but also shows how SIEM will become an essential feature of your security environment.
The Escalating Threat of DDoS Attacks
With increasing frequency and scale, some of the world’s largest data center and network operators are suffering from crippling Distributed Denial of Service (DDoS) attacks.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Personalisation in Drupal
Simplify personalization, empowering marketers and site builders to build immersive and automated personalised digital experiences.