Feeds

The Grauniad corrects an error on its website

Login page XSS, though, not content. No commenter IDs compromised ...

Internet Security Threat Report 2014

The Guardian has fixed a minor cross-site scripting vulnerability on its website.

The flaw, discovered and responsibly disclosed by security researcher Pete Houghton, occurred at the worst possible place on the UK broadsheet's website - right on its login page. Readers use the page to log in and comment on stories. In theory the flaw might have been used to phish the login credentials of Guardian readers. There's no evidence this actually happened.

A Guardian News & Media spokesperson told El Reg: "We have not asked our users to change their passwords as there is no evidence that this flaw was exploited maliciously".

Houghton notified the UK broadsheet about the flaw in early April and it was fixed soon after, The Guardian says. Houghton only published a detailed write-up of the problem last week, however. The bug hunter praised The Guardian's team's overall handling of his bug report.

Cross-site scripting (XSS) vulnerabilities stem from web application development mistakes. Attackers can exploit XSS bugs to inject scripts or pop-ups from untrusted sites so that they appear to surfers as originating from the site they happened to be visiting. XSS flaws are a common class of vulnerability, most regularly abused in phishing attacks.

XSS bugs are bad news whenever they appear but the practical danger they pose is only really worth worrying about when they appear on banking or e-commerce websites. More on the consequences of XSS problems can be found in a guide by the Open Web Application Security Project‬ here. ®

Choosing a cloud hosting partner with confidence

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.