{"id":19787,"date":"2012-06-19T17:18:03","date_gmt":"2012-06-19T23:18:03","guid":{"rendered":"http:\/\/rankexploits.com\/musings\/?p=19787"},"modified":"2013-01-17T08:07:34","modified_gmt":"2013-01-17T14:07:34","slug":"wars-on-hackers-crosdomain-xml","status":"publish","type":"post","link":"https:\/\/rankexploits.com\/musings\/2012\/wars-on-hackers-crosdomain-xml\/","title":{"rendered":"Wars on Hackers: \/crosdomain.xml"},"content":{"rendered":"<p><script type=\"text\/javascript\"><!--\ngoogle_ad_client = \"ca-pub-5474320604265659\";\n\/* HideMyAss *\/\ngoogle_ad_slot = \"7768296086\";\ngoogle_ad_width = 728;\ngoogle_ad_height = 90;\n\/\/-->\n<\/script><br \/>\n<script type=\"text\/javascript\"\nsrc=\"http:\/\/pagead2.googlesyndication.com\/pagead\/show_ads.js\">\n<\/script>Question for those more IT proficient than I. If I am wrong about a certain block, I want to eliminate a particular rule that has blocked a human.  But if I am right, I want them to figure out what is wrong with their browser.<\/p>\n<p>First let me describe two of the rules I use to block access to my site. <\/p>\n<ol>\n<li>If a browser tries to load &#8220;&#8230;.\/crosdomain.xml&#8221; I block that connection.<\/li>\n<li>If a browser presents a cookie with the name &#8220;mp_72366557fd3f1bd4fc7d4bfca5cd0a12_mixpanel&#8221; to my site, I block that connection. The reason is that there is no javascript, php or anything else that sets a cookie of that name at my site. (Or at least I think there isn&#8217;t!)<\/li>\n<\/ol>\n<p>Note: <I>Every single time<\/i> I have seen a browser present that cookie name it has gone on to request &#8220;&#8230;.\/crosdomain.xml&#8221;.  Also, &#8220;&#8230;.\/crosdomain.xml&#8221; does not exist anywhere on my site.<\/p>\n<p>However, if I am wrong about this rule, I would like to lift it. Otherwise, I want to know what and why something is trying to connect to that resource&#8211; which does not exist. Is this something like a favicon.ico that I ought to create? Or what? I note that only a very small fraction of browsers try to hit it&#8211; but obviously, if requesting that is becoming some sort of routine, I don&#8217;t want to be blocking people. <\/p>\n<p><code>#: 66276 @: Tue, 19 Jun 2012 07:19:43 -0700 Running: 0.4.10a1<br \/>\nHost: ----blanked out--<br \/>\nIP: ----blanked out--<br \/>\nScore: 2<br \/>\nViolation count: 2<br \/>\nWhy blocked: ; You asked for  crossdomain.xml ? Hack.  bad cookie:(mp_72366557fd3f1bd4fc7d4bfca5cd0a12_mixpanel,);  cookies:(good:7 other: 0  length:0) ( 0 ); c= AU<br \/>\nQuery:<br \/>\nReferer:<br \/>\nUser Agent: Mozilla\/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident\/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; AskTbIMH6\/5.13.1.18261)<br \/>\nReconstructed URL: http:\/\/ rankexploits.com \/crossdomain.xml<\/code><br \/>\n(Note: I do have many draconian blocks. If people ask nicely I&#8217;ll look into it. But I did get whammied after a complete stranger on <a href=\"http:\/\/rankexploits.com\/musings\/2011\/bezeqint-net-is-this-an-attack\/\">Bezequint<\/a> requested I unblock that site&#8230;. so I am super cautious if someone whose name I don&#8217;t recognize emails me or if they resort to irony in their first email and so on. Sorry&#8230;.but&#8230; well.. In this case, someone asked nicely. I&#8217;m sure he&#8217;s human. I&#8217;d like to find out if my block is wrong. )<\/p>\n<p><b>Update:<\/b> Some are just suggesting I just ignore these attempts to access \/crossdomain.xml for no good reason. However, I would like to point them to what Wikipedia which mentiones this resource in their article about<a href=\"http:\/\/en.wikipedia.org\/wiki\/Cross-site_request_forgery\">Cross Site Forgery<\/a> which they describe as &#8220;under-reported&#8221;.  Here&#8217;s the relevant bits :<\/p>\n<blockquote><p>The attack works by including a link or script in a page that accesses a site to which the user is known (or is supposed) to have been authenticated.[1] For example, one user, Bob, might be browsing a chat forum where another user, Fred, has posted a message. Suppose that Fred has crafted an HTML image element that references an action on Bob&#8217;s bank&#8217;s website (rather than an image file), e.g.,<\/p>\n<p><img decoding=\"async\" src=\"http:\/\/bank.example.com\/withdraw?account=bob&#038;amount=1000000&#038;for=Fred\"><\/p>\n<p>If Bob&#8217;s bank keeps his authentication information in a cookie, and if the cookie hasn&#8217;t expired, then the attempt by Bob&#8217;s browser to load the image will submit the withdrawal form <em>with his cookie<\/em>, thus authorizing a transaction without Bob&#8217;s approval.<\/p><\/blockquote>\n<p>Note: Cookies are used to identify which users are &#8220;known&#8221; to be authenticated.  That&#8217;s why I worry about browsers presenting cookies <i>I did not set<\/i>.<\/p>\n<blockquote><p>CSRF attacks using image tags are often made from Internet forums, where users are allowed to post images but not JavaScript.<\/p><\/blockquote>\n<p>Note that users are allowed to post images here&#8211; but not JavaScript. This is common to WordPress blogs and would be a reason why a script kiddie might try this attack at a blog (or even why someone might just write malware that rides along making attemps wherever it goes). <\/p>\n<blockquote><p>Web sites have various CSRF countermeasures available:<\/p>\n<ol>\n<li>Requiring a secret, user-specific token in all form submissions and side-effect URLs prevents CSRF; the attacker&#8217;s site cannot put the right token in its submissions[1]\n<\/li>\n<li>Requiring the client to provide authentication data in the same HTTP Request used to perform any operation with security implications (money transfer, etc.)<\/li>\n<li> Limiting the lifetime of session cookies<br \/>\n<font color=\"green\">[Since I don&#8217;t set these, I&#8217;m watching for faked cookies whose lifetime I obviously cannot control.]<\/font><\/li>\n<li>Checking the HTTP Referer header or(and) Checking the HTTP Origin header[16]<\/li>\n<li>Ensuring that there is no clientaccesspolicy.xml file granting unintended access to Silverlight controls[17]<\/li>\n<li> Ensuring that there is no crossdomain.xml file granting unintended access to Flash movies[18]<br \/>\n<font color=\"green\">[I don&#8217;t have this file. But I am suspicious when something tries to request it for no reason. &#8211;l]<\/font>\n<\/li>\n<li> Verifying that the request&#8217;s header contains a X-Requested-With. Used by Ruby on Rails (before v2.0) and Django (before v1.2.5). This protection has been proven unsecure[19] under a combination of browser plugins and redirects which can allow an attacker to provide custom HTTP headers on a request to any website, hence allow a forged request.<\/li>\n<\/ol>\n<\/blockquote>\n<p>There is more. But basically, unless I read of a justifiable reason why a browser hits \/crossdomain.xml, I&#8217;m continuuing this block.  <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Question for those more IT proficient than I. If I am wrong about a certain block, I want to eliminate a particular rule that has blocked a human. But if I am right, I want them to figure out what is wrong with their browser. First let me describe two of the rules I use &hellip; <a href=\"https:\/\/rankexploits.com\/musings\/2012\/wars-on-hackers-crosdomain-xml\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Wars on Hackers: \/crosdomain.xml<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[382],"tags":[],"class_list":["post-19787","post","type-post","status-publish","format-standard","hentry","category-spam"],"_links":{"self":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/19787","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/comments?post=19787"}],"version-history":[{"count":0,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/19787\/revisions"}],"wp:attachment":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/media?parent=19787"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/categories?post=19787"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/tags?post=19787"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}