Security Response

On the eve of the much anticipated Pennsylvania Democratic Primary, we received public reports of a series of cross-site scripting vulnerabilities that affected Barack Obama's campaign Web site. We also saw reports of these vulnerabilities being disclosed publicly on the XSSed.com Web site. The corresponding code to exploit the vulnerabilities was used to redirect users to Hillary Clinton’s Web site.

Who says attackers don’t have a sense of humor? While a couple of these vulnerabilities were shored up before we could investigate them, we were able to examine some for validity.

At a high level, what appears to have happened is that an attacker took advantage of the fact that certain parts of the Obama campaign site allows users to post content, for example, in the form of community blog postings. While most users take advantage of such features to post political commentary, at least one user decided to try posting something more insidious.

Here’s how such...

Sometimes in this job you can be a kill joy. Take, for instance, a situation I was involved in a couple of weeks ago. I had the unpleasant task of informing someone that they were not going to be given 12 million dollars.

I had been invited on the morning show at KSON-FM in San Diego. One of the DJs had received an email he wanted to ask me about. I assumed it was a phishing attack, or perhaps the recent IRS scam that Kelly Conley has blogged about. It turned out he had received an email telling him he was going to be given 12 million dollars. I had to ruin his day. He was not going to be rich, and if he wasn’t careful he might become a victim of the old Spanish Prisoner scam.

This con has been around since the 16th century. 500 years ago you would have received a letter from a man held in a Spanish prison. The...

Symantec has been notified that the Web site ladestra.info, a site related to a right-wing Italian political party, has been compromised. The Web site is hosting a malicious iframe that leads to a typical browser exploit using the Neosploit tool, which forces an infected computer to install the newest version of Trojan.Mebroot.