Feeds

The Grauniad corrects an error on its website

Login page XSS, though, not content. No commenter IDs compromised ...

Remote control for virtualized desktops

The Guardian has fixed a minor cross-site scripting vulnerability on its website.

The flaw, discovered and responsibly disclosed by security researcher Pete Houghton, occurred at the worst possible place on the UK broadsheet's website - right on its login page. Readers use the page to log in and comment on stories. In theory the flaw might have been used to phish the login credentials of Guardian readers. There's no evidence this actually happened.

A Guardian News & Media spokesperson told El Reg: "We have not asked our users to change their passwords as there is no evidence that this flaw was exploited maliciously".

Houghton notified the UK broadsheet about the flaw in early April and it was fixed soon after, The Guardian says. Houghton only published a detailed write-up of the problem last week, however. The bug hunter praised The Guardian's team's overall handling of his bug report.

Cross-site scripting (XSS) vulnerabilities stem from web application development mistakes. Attackers can exploit XSS bugs to inject scripts or pop-ups from untrusted sites so that they appear to surfers as originating from the site they happened to be visiting. XSS flaws are a common class of vulnerability, most regularly abused in phishing attacks.

XSS bugs are bad news whenever they appear but the practical danger they pose is only really worth worrying about when they appear on banking or e-commerce websites. More on the consequences of XSS problems can be found in a guide by the Open Web Application Security Project‬ here. ®

Remote control for virtualized desktops

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?