On Mon, Mar 2, 2009 at 6:28 PM, Nick FitzGerald <[email protected]> wrote: > Chris Evans to Thierry Zoller: > >> > Example >> > If a chrome tab can be crashed arbritarely (remotely) it is a DoS attack >> > but with ridiculy low impact to the end-user as it only crashes the tab >> > it was subjected to, and not the whole browser or operation system. >> > But the fact remains that this was the impact of a DoS condition, >> > the tab crashes arbritarily. >> >> Eh? If you visit www.evil.com and your tab crashes, that's no >> different from www.evil.com closing its own tab with Javascript. > > But what if www.evil.com has run an injection attack of some kind (SQL, > XSS in blog comments, etc, etc) against www.stupid.com? > > Visitors to stupid.com then suffer a DoS...
So, you have injected HTML into stupid.com, and you choose to inflict the fury of a closing tab upon hapless visitors? Cheers Chris > > Yes, stupid.com should run their site better, fix their myriad XSS holes, > etc, etc. > > But this is the Internet, so this "software flaw" can be leveraged as > security vulnerability. > > I'm with Thierry on this... > > > Regards, > > Nick FitzGerald > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
