How Genius annotations undermined web security
http://www.theverge.com/2016/5/25/11505454/news-genius-annotate-the-web-content-security-policy-vulnerability
Until early May, when The Verge confidentially disclosed the
results of my independent security tests, the "web annotator"
service provided by the tech startup Genius had been routinely
undermining a web browser security mechanism. The web
annotator is a tool which essentially republishes web pages in
order to let Genius users leave comments on specific passages.
In the process of republishing, those annotated pages would be
stripped of an optional security feature called the Content
Security Policy, which was sometimes provided by the original
version of the page. This meant that anyone who viewed a page
with annotations enabled was potentially vulnerable to
security exploits that would have been blocked by the original
site. Though no specific victims have been identified, the
potential scope of this bug was broad: it was applied to all
Genius users, undermined any site with a Content Security
Policy, and re-enabled all blocked JavaScript code.
- - -
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
I have consulted to Google, but I am not currently
doing so -- my opinions expressed here are mine alone.
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
