Phishing based on XSS (Same vulnerability but a different attack that the similar September 2004 attack)
Date:
01 November 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authentication, Predictable Resource Location
Following a software upgrade, Cahoot, a UK based Internet only bank allowed accessing user accounts by guessing their user names. At least on one page allowed accessing an account by only specifying the user name in the URL. The bug was open for 12 days before being discovered.
The site was taken off line for 10 hours to fix the issue. It is a significant incident, as it is one of those rare occasions where vulnerability was serious enough to force the organization to just take the site off line until it is fixed.
We somehow missed this story so it finds its way to WHID only now in late 2007.
References:
Date:
27 October 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
An XSS was found in G-Mail
References:
Date:
28 September 2004
Incident Type: Security Breach
WASC Threat Classification: Content Spoofing, Cross-site Scripting
Phishing based on XSS
References:
Date:
01 September 2004
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
This entry is a very important one. Most are already familiar with the infamous CardSystems incident where hackers stole 263,000 credit card numbers, exposed 40 million more and several million dollars fraudulent credit and debit card purchases had been made with these counterfeit cards. As a result of the breach CardSystems nearly went out of business and was eventually purchased by PayByTouch. CardSystems is considered by many the most severe publicized information security breach ever and it caused company share holders, financial institutes and card holders damage of millions of dollars.
But since the publication of the incident a year ago the way in which the breach occurred remained a mystery.
Recently new articles about the case (listed below) revealed that SQL injection was used by the attackers to install malicious script on the CardSystems web application database which where scheduled to run every four days, extract records, zip them and export them to an FTP site.
This is one of the most stunning examples where a web application security hole was used to launch a targeted attack in order to steal money.
References:
Date:
30 June 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting, SQL Injection
References:
Date:
14 June 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authentication, Insufficient Authorization
A billing information system required only phone number and zip code to pull up account details
References:
Date:
04 March 2004
Incident Type: Security Breach
WASC Threat Classification: Insufficient Authorization
Previously moderated weather announcements could be changed by the user
References:
Date:
02 February 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization
References:
Date:
02 February 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction
References:
Date:
02 February 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: SQL Injection
References:
Date:
02 February 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization
References:
Date:
02 February 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization
References:
Date:
26 January 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization
References:
Date:
26 January 2004
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction
References:
This work is licensed under the Creative Commons Attribution License. To view a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.
