WordPress Sites Vulnerable By Leak Into Postman SMTP Plug-In

Over 100,000 WordPress sites are vulnerable due to a vulnerability in the Postman SMTP plug-in, and a developer security update is not yet available. Postman is an SMTP mailer that helps send emails generated by the WordPress site.

The plug-in is vulnerable to reflected cross-site scripting, which allows an attacker to steal the content of cookies from, for example, the administrator, according to security company White Fir. Due to the unpatched vulnerability, WordPress decided to remove the plug-in from the database with available plug-ins on WordPress.org . Meanwhile, GitHub has published a patched version of Postman, but it has not been developed by the original author. The original developer would have been informed about the problem.

"A Quarter Of IoT Devices Is Leak '

Connecting IoT devices in the home is like playing Russian roulette. Nearly one in four 'connected' devices for home use is not secured. Or there are errors in the firmware or the Web portal to gain access to the device is not secure enough. That's the conclusion of researchers from the French Eurecom and the Ruhr University in Bochum, Germany. They examined the firmware on routers, modems, VoIP phones, network cameras and other IoT devices that can be managed via the internet.

Attempts were made to undermine security by customizing the firmware by malicious software updates, but also to attack the web portal of the aircraft. The portals were exposed to frequent attacks such as XSS (cross-site scripting), CSRF (cross-site request forgery), SQL injection and RCE (remote code / command execution).

In total, were investigated in 1925 firmware images from 54 different manufacturers. More than 9200 vulnerabilities were found in 185 firmware images. Although only 8 percent of the firmware php code contained in the management of the portal, was found in 143 firmware images whopping 5000

XSS Vulnerabilities.

The study seems to confirm what even last week at Black Hat Europe emerged. A survey conducted by Information Week and Dark Reading which showed that IT professionals believe that in two years the security of IoT will be a top priority. Now the priority is still mainly in the security of applications and end users.

New Browser-Attack Reveals Surfing Behavior On Websites

One researcher has demonstrated a new browser attack that websites can retrieve the browsing habits of visitors, as well as the browsing history before the user is deleted. The attack uses HTTP Strict Transport Security (HTST) and Content Security Policy (CSP).

HSTS allows websites visited to visit via HTTPS only over HTTPS, even though HTTP is introduced into the address bar.The browser in this case captures the user's command and turns off automatically in HTTPS. CSP is a measure to prevent cross-site scripting. The attack this weekend during the ToorCon conference was demonstrated by researcher Yan Zhu(pdf).

Attack

In order to carry out the attack must embed a malicious page images from a website-HSTS. However, the browser will attempt to load the images via HTTP. CSP is then used to prevent HSTS ensures that they are loaded via HTTPS. In the case CSP an image block this causes an error message. Based on the time it takes for the error message can be determined whether the Internet user HSTS the website from which the image was attempted to load previously visited.

Besides the explanation in her own weblog has Yan Zhu also a demonstration page put online that only works with Chrome and Firefox. Additionally, the HTTPS Everywhere browser plug-in must be disabled. Could be found only previously visited websites that make use HSTS. On Hacker News suggested that websites can avoid the attack by their domain to the HSTS preload ruse to add like. In this case the hardcoded domain name included in the browser so that is visited only via HTTPS. An employee of Mozilla calls it on Reddit a "smart attack" and states that the browser developer looking for a solution.

Netflix Launches Open Source Tool Against Cross-Site Scripting

Video streaming service Netflix has a opensource tool launched that allows web applications on their cross-site scripting can test. Cross-site scripting (XSS) is a problem that places an attacker to run code on a website which is then executed in the browser of visitors.

In this way, an attacker can steal cookies, for example, and thus gain access to the account of a user. Although XSS already been known for years, it is since 2004 in the OWASP Top 10 most common security problems. According to recent research would be almost half of web applications contain one or more XSS vulnerabilities.

There are already several tools available to detect XSS problems, just as Netflix cover that not everything within an application or multiple applications for which a security engineer is responsible. For example, the tools do not test for XSS in secondary applications. As a solution, Netflix decided to develop in their own words more complete framework for testing for XSS, which should make it easier to identify XSS, so to overcome the problem quickly.

The result is "Sleepy Puppy", as the tool is called. Through the framework can security engineers the process of finding, managing and tracking XSS over longer periods and simplify multiple assessments. Netflix, the tool also open source created. The video streaming service says Sleepy Puppy also be used for finding XSS and wonders how the open source community, the tool will use. According to Daniel Miessler HP and OWASP, who was already a demonstration in July, Sleepy Puppy is a promising tool.