Skip the navigation

Read RSS, get hacked

Hackers have found a really simple solution to delivering malware

February 21, 2007 12:00 PM ET

Computerworld - Users of Web feed services such as Real Simple Syndication (RSS) and Atom might want to make doubly sure they are not downloading malicious code along with their favorite Web content.

That's because the growing use of Web feed readers and the proliferation of content-aggregation sites are giving hackers a really simple way to deliver keystroke loggers, Trojan horses and other malware onto their computers, security analysts warn.

The feed-hacking threat is not particularly new. Howev—er, the severity of the problem could be rising as feed services begin moving into the mainstream, said Ray Dickenson, vice president of product management at Authentium Inc., a Palm Beach, Fla.-based security vendor. "Malware authors are just taking advantage of the interconnectedness of Web 2.0" to distribute their code more efficiently, he said.

Web feed services such as RSS allow Web content from multiple sources to be aggregated and automatically delivered to a desktop without requiring the user to actually visit any of the content-providing sites. Users simply subscribe to syndicated news and content feeds. Then, feed readers and content aggregators regularly check the feeds for updated content on the users' behalf -- and automatically push it out to the user when something new is found.

The security problem arises from the fact that many RSS- and Atom-based feed readers and aggregators simply pull in the content from the source without first checking to see whether it might contain malicious code, said Michael Sutton, security evangelist at SPI Dynamics Inc., an Atlanta-based Web application security vendor.

"It is like any other Web application security problem," Sutton said. "It all stems from the problem that user input is widely accepted without any validation. It's a huge problem. The server side and the client side are assuming that people are going to be inputting stuff the developer expected them to."

In other words, feed readers assume that the content being pulled in is a story or a blog and make little attempt to sanitize the content, he said. That makes it easier for attackers to inject into a Web feed malicious JavaScript and other code for stealing passwords and data or for remotely controlling computers, said Jeremiah Grossman, founder and chief techology officer at WhiteHat Security Inc. in Santa Clara, Calif.

"Unfortunately, many of the applications that receive [feed] data do not consider the security implications of using content from third parties and unknowingly make themselves and their attached systems susceptible to various forms of attack," Robert Auger, formerly of SPI Dynamics, said in a white paper released last year.

As a result, the "potential for using Web-based feeds as an exploit deployment vector for both known and zero-day exploits is rather large," he said. The issue is amplified when a feed is resyndicated to other sites. "The potential exposed user base could be in the millions, making it an attractive method for worm deployment," Auger wrote.

Our Commenting Policies
Internet of Things: Get the latest!
Internet of Things

Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!