Hacker News Reader

Full thread

lightyrs

This is way over my head but seems very problematic.

View on HN

Unless I'm misunderstanding scenario is this:

1) Fancy app website uses iframes to send messages to itself/its server

2) attack website embeds app in an iframe

3) attack website changes the URLs of the apps iframes to point to attacker-controlled pages

4) app sends sensitive info to its iframes, which of course ends up going to the attacker

yes, thats right

yes, explanation is a bit short. i can explain if any part is unclear

yes, please, if you could explain for non security experts what we can do to protect our pages from this vulnerability, and also please clarify if it's relevant to web pages that don't use frames / iframes (I guess some of us just shrug and say, "hm.. clever post, I wish I had the time to dive into this, but I don't plan to try to use this to attack other sites, and it's probably not relevant for me since I don't have any frames" so a simplified clarification will be highly appreciated)

1) SAMEORIGIN/DENY is good protection, as said above 2) If you don't interact with frames(window.length==1) and don't have Like buttons - you are not vulnerable

Reply on news.ycombinator.com