Content Spoofing - Revision history

D0ubl3 h3lix: /* Attack Scenario */

2018-04-04T05:17:34Z

‎Attack Scenario

2018-04-04T05:16:11Z

‎Risk Factors

2018-03-17T13:19:10Z

‎Description

2018-03-17T13:16:45Z

‎Threat Agents

2018-03-17T13:13:30Z

2018-03-17T13:06:50Z

2018-03-03T11:21:41Z

‎Text Injection

2018-03-03T11:20:58Z

‎Text Injection

2018-03-03T11:17:35Z

‎Applicable Industries

2018-03-03T11:17:14Z

‎Related Threat Agents

@@ Line 21: / Line 21: @@
 ==Attack Scenario==
-An attacker compromised social accounts which have thousands of followers and distribute misleading Content Spoofing payload via Twitter/Facebook/Instagram/ similar popular channel.
+An attacker compromised social accounts which have thousands of followers and distribute misleading Content Spoofing payload via Twitter/Facebook/Instagram/ similar popular channel.  This will lead media to assume news is correct and create headline stories.
 ==Applicable Industries ==

@@ Line 13: / Line 13: @@
 ==Risk Factors==
-Risk factors depend on the business type of the application.  If the application business brand is well known and has major competitors,  this issue can be abused by malicious competitors/disgruntled employees/unsatisfied customers to trigger mass distributions of false messages to unsuspecting customers. By doing so, customers could be forced to switch to competitor's products.  This could lead to loss of thousands of monetary value until rectification is properly done by the victim business. Another factor that heightens the risk is by doing SEO injection in a way that search engines crawl and index crafted URLs with falsified messages.
+Risk factors depend on the business type of the application.  If the application business brand is well known and has major competitors,  this issue can be abused by malicious competitors/disgruntled employees/unsatisfied customers to trigger mass distributions of false messages to unsuspecting customers.  Another factor that heightens the risk is by doing SEO injection in a way that search engines crawl and index crafted URLs with falsified messages.
 [[File:Fake-text.png|thumb]]

@@ Line 9: / Line 9: @@
 Content spoofing, also referred to as ''content injection'', "arbitrary text injection" or ''virtual defacement'', is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user. This presents the user with a modified page under the context of the trusted domain.<br>
-This attack is typically used as, or in conjunction with, social engineering because the attack is exploiting a code-based vulnerability and a user's trust.
+This attack is typically used as, or in conjunction with, social engineering because the attack is exploiting a code-based vulnerability and a user's trust.  As a side note,  this attack is widely misunderstood as a kind of bug that brings no impact.
 ==Risk Factors==

@@ Line 34: / Line 34: @@
 * Disgruntled employees
 * Unsatisfied customers
-== Content Spoofing vs. Cross-site Scripting<br> ==
+== Content Spoofing vs. Cross-site Scripting  ==
 Content spoofing is an attack that is closely related to [[Cross-site Scripting (XSS)]]. While XSS uses [https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet <script> and other techniques] to run JavaScript, content spoofing uses other techniques to modify the page for malicious reasons.

@@ Line 13: / Line 13: @@
 ==Risk Factors==
-Risk factors depend on the business type of the application.  If the application business brand is well known and has major competitors,  this issue can be abused by malicious competitors/disgruntled employees/unsatisfied customers to trigger mass distributions of false messages to unsuspecting customers. By doing so, customers could be forced to switch to competitor's products.  This could lead to loss of thousands of monetary value until rectification is properly done by the victim business.
+Risk factors depend on the business type of the application.  If the application business brand is well known and has major competitors,  this issue can be abused by malicious competitors/disgruntled employees/unsatisfied customers to trigger mass distributions of false messages to unsuspecting customers. By doing so, customers could be forced to switch to competitor's products.  This could lead to loss of thousands of monetary value until rectification is properly done by the victim business. Another factor that heightens the risk is by doing SEO injection in a way that search engines crawl and index crafted URLs with falsified messages.
 ==Attack Scenario==

@@ Line 138: / Line 138: @@
 * OWASP Guide to Building Secure Web Applications and Web Services, Chapter 8: [[Data_Validation|Data Validation]]
 * HTML Code Injection and Cross-site Scripting: http://www.technicalinfo.net/papers/CSS.html
+* Case studies (Spotify, LinkedIn, ..etc): https://twitter.com/ncweaver/status/974802236567007232?s=12
 [[Category:Injection]]
 [[Category:Attack]]

@@ Line 108: / Line 108: @@
 '''Modified Page'''
 <pre>
-http://vulnerablesite/suggestions.php?stockid=123&stockrecommendation=Our+site+has+experienced+major+hacking+incident.Please+use+our+competitor+site+http://www.competitor.com+until+we+further+annouced+for+update.
+http://vulnerablesite/suggestions.php?stockid=123&stockrecommendation=Our+site+has+experienced+major+hacking+incident.Please+use+our+competitor+site+http://www.competitor.com+until+we+further+announced+for+update.
 ==Related [[Attacks]]==

@@ Line 103: / Line 103: @@
 http://vulnerablesite/suggestions.php?stockid=123&stockrecommendation=We+Really+Recommend+You+Sell+This+Stock+Now
 </pre>
 ==Related [[Attacks]]==

@@ Line 26: / Line 26: @@
 * A business entity relying on the brand name
 For example,  Cosmetic brand,  Airline brand
 == Content Spoofing vs. Cross-site Scripting<br> ==