13961610
story
Comments: 224 + - News: YouTube Hit By HTML Injection Vulnerability on Sunday July 04, @12:35PM
background: url(//a.fsdn.com/sd/topics/topicyoutube.png); width:100px; height:45px;
youtube
background: url(//a.fsdn.com/sd/topics/topicgoogle.gif); width:104px; height:38px;
google
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
background: url(//a.fsdn.com/sd/topics/topicnews.gif); width:60px; height:66px;
news
Virak writes "Several hours ago, someone found an HTML injection vulnerability in YouTube's comment system, and since then sites such as 4chan have had a field day with popular videos. The bug is triggered by placing a <script> tag at the beginning of a post. The tag itself is escaped, but everything following it is cheerfully placed in the page as is. Blacked out pages with giant red text scrolling across them, shock site redirects, and all sorts of other fun things have been spotted. YouTube has currently blocked such comments from being posted and set the comments section to be hidden by default, and appears to be in the process of removing some of these comments, but the underlying bug does not seem to have been fixed yet."
Related Stories
The FALAFEL SANDWICH lands on my HEAD and I become a VEGETARIAN ...
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.
Series of tubes... (Score:5, Funny)
All of your tubes are belonging to US now.
Re:Series of tubes... (Score:5, Funny)
Somebody set up us the script bomb
Parent
Re: (Score:2, Informative)
Don't you mean...
"Somebody script up us the bomb"
Re: (Score:3, Insightful)
Really? They're really only removing some of them? When they can just do a simple delete query and wipe everythin with a properly escaped script tag at the top of the comment? Wow. Just wow.
The solution to this is for users to be asked if they want to participate in commented sections when signing up. Not just at youtube, but everywhere. And probably not just comments, but any user input area.
Re:Series of tubes... (Score:5, Funny)
Really? They're really only removing some of them? When they can just do a simple delete query and wipe everythin with a properly escaped script tag at the top of the comment? Wow. Just wow.
Shhh.... one word... overtime pay.
Parent
Re:Series of tubes... (Score:5, Funny)
Parent
Re:Series of tubes... (Score:5, Insightful)
YouTube has currently .... set the comments section to be hidden by default
This is the greatest possible improvement to YouTube short of removing the comments section entirely.
Parent
I experienced this! (Score:5, Funny)
I went to youtube, but all I saw was crap material. Someone had injected a bunch of crap!
Evolution of an exploit (Score:5, Informative)
The evolution of this bug exploit was quite interesting to follow up close.
At first it simply prevented any further comments to be posted.
Then text was added.
Then the text was scrolling.
Suddenly, the entire page was blacked out except for the added text.
And that's when the more technical minded people realized much much more was possible.
Bam! Popups!
Infinite popups that lead to browser crashes!
Page redirects to shock sites!
The most sophisticated version I saw actually replaced the Youtube video in-place with the 1man1jar video..
And when the exploit was blocked in the comments, it had a small resurgence as video reply title, before being smacked down once more.
Glorious.
Re:Evolution of an exploit (Score:5, Interesting)
Parent
Re:Evolution of an exploit (Score:5, Insightful)
I'm really surprised it used for trolling rather than making money. That seems like a phishers wet dream.
Parent
Re:Evolution of an exploit (Score:4, Interesting)
I saw someone on /g/ claim to have pulled 300k+ youtube user cookies doing this. The bad thing is your YT account is usually tied to gmail now. Scary... glad I had noscript on.
Parent
An update (Score:5, Informative)
They actually got it fixed a bit after I submitted this story. A shame, lemonparty was a big step up from the usual level of discussion on YouTube videos. More seriously, I'm interested in finding out exactly what happened here. Hopefully Google will post some sort of explanation. YouTube is a massive site and it's somewhat bizarre seeing them make the sort of mistake you'd expect from something put together by a drooling moron with nothing but a "How to learn PHP in 24 hours!" book.
Why natural language needs grouping symbols (Score:5, Funny)
a "How to learn PHP in 24 hours!" book
Does that mean:
1. It teaches you, over the course of an unspecified period of time, how to learn PHP in 24 hours?
2. It teaches you, over the course of 24 hours, how to learn PHP? or
3. After 24 hours have elapsed, it teaches you how to learn PHP?
Note that it doesn't actually teach you PHP. It just teaches you how to learn it.
Parent
Re: (Score:2)
Actually, it teaches you PHP if you're on the cast of '24 hours'
Re: (Score:3, Funny)
No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.
Re:Why natural language needs grouping symbols (Score:5, Funny)
No, it tells you how you learn the lesser-known language named "PHP in 24 hours" which differs from normal PHP in that the scripts always take 24 hours to run.
An optimized version, then? ;)
Parent
Re: (Score:3, Funny)
I can't wait 24 hours! Got to get 12 hour book...
Re: (Score:3, Funny)
I've seen the book, option 3 is the correct answer.
It's 1,440 pages of "Wait one minute, then turn the page" which sadly forces one into an inescapable loop for 24 hours. After one has starved, missed sleep and soiled oneself through this excruciating 24 hour period the last page says only this:
Buy the book titled 'This book teaches you PHP'.
I was thoroughly disappointed.
Re:Why natural language needs grouping symbols (Score:5, Funny)
The first time I hear anyone ever fucking utter the word "Kibisecond" I'm just going to shoot them in the face. There's no other choice.
Parent
Re: (Score:3, Insightful)
It's been nice knowing you.
Re: (Score:3, Funny)
Dont worry, he'll be back in a kibisecond.
tags, quoting and XSS (Score:2)
If I had to guess, I think it's a variant of an attack [notmysock.org] I've seen before.
Re: (Score:2)
Yes, this does seem like the kind of bug I'd expect halfway competent dev to take into consideration when building a site. A very simple fix is to translate all < and > characters to the & lt; and & gt; versions instead, AFAIK youtube doesn't even allow HTML in comments anyway...
They hid all comments... (Score:5, Insightful)
... if you want to keep it (Score:5, Informative)
Get the YouTube Comment Snob [mozilla.org] addon for Firefox.
YouTube Comment Snob filters out undesirable comments from YouTube comment threads. You can choose to have any of the following rules mark a comment for removal:
* More than # spelling mistakes: The number of mistakes is customizable, and the extension uses Firefox's built-in spell checker.
* All capital letters
* No capital letters
* Doesn't start with a capital letter
* Excessive punctuation (!!!! ????)
* Excessive capitalization
* Profanity
Parent
Re:... if you want to keep it (Score:5, Funny)
*Reads list of filtering options*
So does it just hide the whole comment section, or show it as being empty?
Parent
Re:doesn't work anymore (Score:5, Informative)
I'm the author, and I uploaded a new version that works with the latest YouTube design a few days ago. It's just pending approval by Mozilla.
Parent
Re: (Score:2)
as usual, xkcd has this covered: (Score:3, Interesting)
Really? (Score:2, Interesting)
Re:Really? (Score:5, Insightful)
Wow. You'd think somebody would've figured out something like this a long time ago.
But since merely gazing at youTube comments lowers your IQ by at least 20 points, I'm actually amazed someone found it. Must have used some of kind of proxy who looked at it, got dumber for it, but managed to pass along the code to someone who could look at it without being exposed to the dumb.
Parent
The very definition of Youtube (Score:5, Funny)
This exploit is just an alternative to the original "Upload Video" button.
I'd love to see the Comments removed period (Score:2, Interesting)
A lot of the comments are just troll BS. Most people log on for videos not to read the ramblings of basement dwelling trolls. I try to ignore them but they can be really obnoxious. I don't post on Youtube but I have had things pirated and posted just so they could make obnoxious comments. The work posted was just previs stuff that was just done for editing slugs but it was presented as finished work. It caused some trouble with a client so I got a lot more careful about letting development work out there. I
Re:I'd love to see the Comments removed period (Score:5, Interesting)
A lot of the comments are just troll BS.
Yes, but I blame the comment system for that. A comment system that doesn't allow links, doesn't allow more then a handful of characters, is a complete usability nightmare when you want to browse more then the last ten comments, doesn't allow search and doesn't support threads or replies properly is just useless when you actually want to write something insightful. A comment system should encourage informative posts, not make them impossible like the Youtube system does.
The latest changes that the highest rated comments and comments from the video upload appear on top have helped a bit to cleanup the mess, but its still far away from being a comment system where people actually can have a meaningful discussion.
Parent
Re: (Score:3, Informative)
If you don't want to spare the bandwidth on your own site (how much data are you pushing, anyway?) then try Vimeo. Cleaner, better optimization, has private (need a password) channels, offers a "pro" service where you get unlimited uploads, etc.
It's mainly used by video artists, tech demos, etc.
Exploits (Score:2)
I wonder how many times this vulnerability was used to deliver malware.
Interest pondering the how and why of such fails (Score:3, Interesting)
I find it interesting pondering the how and why these things fail-- the insight into how the code must have been put together to fail on a particular input.
My initial guess for this one would be that they escape html and scripts separately-- scripts do not need greater than, less than, and ampersand escaped-- and that detecting the keyword 'script' switched modes from html to script. The fact that the first script tag is properly html-escaped suggests that while it was properly detected, the code to switch between html and script modes did not take this detection into account and switched anyway. I'm going to further guess that this do to some support code meant for the programmers' side inadvertently managed to cross over into user land.
My two cents.
--Dave Romig, Jr.
Re: (Score:2)
Why would they have a distinction between a HTML and a script mode on comments? Is there any reason you'd ever want a comment to contain a script?
Massive rickroll? (Score:5, Funny)
If they didn't redirect ALL videos to a Rick Astley video, they have missed the opportunity of a lifetime.
Is it Christmas already? (Score:5, Interesting)
Comments turned off by default? Great! Any chance they can make that permanent?
Re: (Score:3, Insightful)
The comments never bothered me. I simply don't read them.
Re:Is it Christmas already? (Score:5, Informative)
Any chance they can make that permanent?
Use Addblock Plus and add the following element hiding rules:
##div#watch-discussion
##div.watch-comment-entry
Parent
Trolling as a method to expidite bug fixes? (Score:5, Interesting)
Since this was turned in to a massive, YouTube-wide trolling effort, it's being fixed nearly immediately. What if 4chan hadn't gotten a hold of it though? What if some scammers/spammers did? And used it for weeks? It would have been more subtle, and with YouTube's traffic, it could have been massively successful. Who knows what effect that could have had if this wasn't caught quickly. Did 4chan just do a good thing?
What I learned from this story (Score:4, Funny)
What I learned from this story:
That goatse.cx is very old news and that there are whole new horrors I never even heard of.
Someone must be looking out for me.
You know you are living a blessed life when you got no idea what 1man1jar or lemon party is. Reminds me of being a little kid and having no idea what the adults were talking about. Only this time I know the value of ignorance.
Let me see. 1 man 1 jar, must be about a man collecting pennies to buy a gift for his mother.
Lemon party? Sweet lemonade for a hot summer day? Sounds fun.
2girls1cup? Two girls riding the magic cup at disney?
Please, don't correct me. Ignorance is bliss.
Re:Ha ha (Score:5, Funny)
Based on the typical YouTube comment (or video, for that matter), I already hard sort of expected that to be the case.
Parent
Re:Ha ha (Score:5, Funny)
YouTube is supposed to be a kid-friendly place. Parents could do their best to try to responsibly monitor and guide their kids' surfing habits, but still fail because of this exploit. This is not funny, nor awesome. This is not someone finding a potential exploit and graciously letting Google know so they can patch it up. Just a bunch of 4channers screwing around, and to hell with the consequences. And people like you encouraging that type of behaviour.
Just because this is The Internet(TM), it doesn't mean that common courtesy need not apply.
Parent
Re:Ha ha (Score:5, Insightful)
Physical age doesn't necessarily correspond to mental age. Personally, I've been getting more immature as years pass.
Parent
Re:Ha ha (Score:5, Funny)
Physical age doesn't necessarily correspond to mental age. Personally, I've been getting more immature as years pass.
"I have abandoned the quest for eternal youth and instead setttled for lifelong immaturity"
Parent
Re:Someone needs to lose their job over this (Score:5, Informative)
This isn't a simple mistake, it's a sign of pure incompetence since the developer put no forethought into the uses of the tool he was developing and blindly trusted user input from a textarea. User input is dirty, dirty dirty and any developer who does not clean and sanitize it before consuming it is not doing his/her job.
The summary states that the first script tag was escaped as it should be. It was a bug, not a lack of foresight.
Parent