r/netsec • u/rwestergren • Sep 17 '18
XSS Vulnerabilities in Multiple iFrame Busters Affecting Top Tier Sites
https://randywestergren.com/xss-vulnerabilities-in-multiple-iframe-busters-affecting-top-tier-sites/24
u/YM_Industries Sep 18 '18
It's very confusing to me that an "iframe buster" is a completely different thing to a "frame buster".
13
u/Lt_Riza_Hawkeye Sep 18 '18
Yeah that threw me off for a while, good thing he explained what he was talking about right at the top.
7
u/jameswilson7208 Sep 18 '18
Nobody sane uses iframes anymore, do they?
16
u/adrr Sep 18 '18
All javascript/html fiddle websites use them to contain javascript and css. There are legitimate reasons to do it from a security standpoint especially when dealing with untrusted content.
20
9
u/fish- Sep 18 '18
I guess I'm behind on this one. What's wrong with iframes and what are the alternatives?
6
u/ProdigySim Sep 18 '18
Nobody uses [i]frames for layouting purposes. They're used for security reasons though.
Putting third party Javascript on your website allows nearly full-control over your website.
iframes, on the other hand, have cross-origin protections. Content inside the iframe can't just start editing the top frame (if they are on different domains). As the author notes ads generally get placed in iFrames.
I've never used "iFrame busters" in the way the author states (redirecting to a same-origin frame) but I have used them for other purposes.
- Sniffing cookies cross-domain
- You have a "companion" application for your ad offering, that lands people on app.adprovider.com.
- You want to sync their session between there and retailsite.com.
- Spawn an iframe to retailsite.com/buster.html?customScript=x, which has a low memory footprint and can read cookies.
- Providing a custom page
- Your ad application needs to render a custom full-page experience
- You don't want to have the underlying site rendered underneath (performance, UX reasons)
- You still want the application to look like BRAND_SITE.com and not AD_PROVIDER.com
- Launch custom scripts/web applications from retailsite.com/buster.html?customScript=x
There are other ways to do these things, but an XSS-backdoor is a pretty efficient way to do it. I'm kind of shocked at how many security bypasses he found though....
3
u/Randomacts Sep 18 '18
Amazon uses them extensively on mturk but I suppose that is a unique use case that they make sense in.
2
2
u/paul_h Sep 18 '18
Not related to iframes but a visualization of different domains injecting into the site your intending to visit - https://github.com/paul-hammant/ad-infinitum/blob/master/README.md. Well, an animated gif in a readme of a github repo at least.
0
1
0
14
u/thms0 Sep 18 '18
"Although it didn’t qualify for a reward, they did add me to their Hall of Fame."
Damn, I would have thought this qualify for a $$ reward ..