The Cross Site Scripting Worm and the Black List

Last week, the Samy Worm gained notoriety as the first Cross Site Scripting worm. The author explained the technical details of the worm here.

The Samy worm is a good study on the challenges black list filters face. MySpace.com, the victim, used a black list filter to counter Cross Site Scripting (CSS) attacks. I guess they knew they were a candidate for CSS attacks as they followed several techniques to counter CSS.

The MySpace black list filtered out the keywords that can carry CSS payloads: <script>, javascript, <body>, onClick, innerHTML, etc. Further it stripped all escaped single and double quotes. It even blocked "onreadystatechange" which is used in more advanced CSS attacks to invoke XML-HTTP requests.

Then, what went wrong? A combination of things, really.

The attacker evaded the filter by splitting the keywords into smaller parts, and then recombining them at runtime. eg. eval('document.body.inne' + 'rHTML') would go unstopped through a black-list on the lookout for innerHTML. At run time, that expression evaluates to "document.body.innerHTML" and can be used from within the script.

Similarly, double-quotes were also embedded in run time by calling a function that converted the decimal value 34 to the ASCII double-quote. The filter would let String.fromCharCode(34) to go through, not realizing that the adversary had sneaked in a double-quote.

Thirdly, the attacker exploited some browsers' leniency in accepting HTML tags. Internet Explorer, for instance allows newlines inside tags. Thus, IE interprets
<java
script>

as <javascript>; the MySpace black-list filter is stricter and does not interpret the two as the same: more tags were sneaked in this way.

Why didn't MySpace just use a whitelist? That's the tricky part. It's difficult to define white lists for free-flowing text boxes that accept a wide range of inputs. And MySpace was faced with just that. For the features MySpace offered, a whitelist would have been nearly impossible to define.

The debate on strategies to prevent CSS will heat up further as sites prepare to defend against CSS worms.