Re: iframe tag attack

Using Rachna's unpack (thanks for that!) the way I see it ... 

1. is definitely out of scope. 

2. is strange - the fact that the site is compromised makes me think this is out of scope, but must any identity mechanisms that we do accept as in scope protect users from these types of problems? 

3. feels in scope to me, especially if the iframe is doing things where a site which is trusted/identified in one way is loading content form a site that is not trusted, and then presenting it as part of the trusted site. I understand that this is a common practice amongst websites, but we need some mechanisms for enabling it without enabling this type of compromise as a side effect, IMO. Also, we need a pony. 

4. the browser exploits that result in downloaded and installed malware are in scope, but once infected, the effects of that malware are totally out of scope. 

imo, fwiw, etc. 

cheers, 
mike 
----- Original Message ----- 
From: "Rachna Dhamija" <rachna.w3c@gmail.com> 
To: "Bill Doyle" <wdoyle@mitre.org> 
Cc: public-wsc-wg@w3.org 
Sent: Tuesday, June 19, 2007 6:21:18 PM (GMT-0500) America/New_York 
Subject: Re: iframe tag attack 

On 6/19/07, Doyle, Bill < wdoyle@mitre.org > wrote: 




This enterprising company seems to have improved productivity. 

New Web Exploit at 10,000 Machines and Growing, Security Company Warns 

Seems to be a user agent issue, is this in or out of scope? 

If we unpack the attack, this question might be easier to answer: 
1) Attacker compromises a web server using malware 
2) User visits a legitimate, but compromised, website that includes malicious iframe 
3) iframe causes browser to be redirected to a site with malicious javascript 
4) malicious javascript detects the browser type and exploits browser vulnerabilities to download code, which then downloads other code (keyloggers, proxy, etc...) 

We have ruled 1 out of scope. How about the rest? 

I am hoping that we can use our list of attacks (i.e., the threat trees) to come to a better understanding on what is in and out of scope. 

Rachna