Cross-Site, Cross-Service

An Italian researcher has found a way to spread a Webmail worm to every user in a victim's address book, no matter which client they may use.

Rosario Valotta, an independent researcher, has published a proof of concept which demonstrates that Webmail clients from multiple service providers can be exploited simultaneously via cross-site scripting vulnerabilities that they all have in common. The exploit shows that Webmail-borne worms can be propagated at rates much faster than previously thought.

Webmail worms, like many other email attacks, spread by accessing a victim's address book and replicating themselves to addresses that use the same Webmail client. Users who were in the address book, but used a different Webmail client, were previously considered safe -- until Valotta demonstrated the spread of a Webmail worm across clients provided by four different Italian Internet service providers.

The proof of concept, dubbed the "Nduja Connection," is Valotta's first worm. In an email interview, he says he developed the exploit to help stir some action by ISPs, many of which are subject to XSS vulnerabilities.

"At the beginning, I thought that the XSS [vulnerability] I found was an isolated case, but after few searches, I realized that the problem had a bigger 'scope' -- most Websites are affected by some kind of application security vulnerability," Valotta observes. "Furthermore, security people's concerns about XSS were ignored by providers -- they were sure that users' security could never be threatened by XSS.

"So I thought, 'What could scare users and providers more than the risk of seeing their private communications published, in real time, somewhere over the Web?' " Valotta says. "And here is the worm."

Valotta's proof of concept works only for four Italian ISPs' Webmail clients -- Excite, Libero, Lycos, and Tiscali -- but it could be extended to other service providers, he says.

"I'm quite sure that the same kind of (XSS) vulnerabilities that let the worm spread [in Italy] can be found as well in U.S. or other countries' provider Websites," Valotta says. "It's just a question of how much time you want to spend searching for XSS holes."

Like many other researchers, Valotta says he hopes his efforts will help prove that enterprises need to be wary of application security issues.

"XSS is not a new issue, but its severity has always been underestimated," Valotta says. "IT professionals should be aware that in the Web 2.0 era, the worst threats will come from the front door -- public consumer Websites -- not from the back door." (See Beware of the Quiet Ones and Putting App Security to the Test.)

— Tim Wilson, Site Editor, Dark Reading