[ news_security_news ]
Netscape Responds To Hacker's Claims
SecurityProNews
Staff Writer
2006-08-07
 Insider Reports RSS Feed
The hacker that cracked Netscape's cross-site scripting (XSS) vulnerability and used it to deface the company's answer to Digg.com maintains that he tried incessantly to contact Netscape about the problem to warn them before hand. Netscape thinks he didn't try hard enough.
Last Friday, SecurityProNews published an interview with "D," the one who hacked the site. D claimed his motivations were pure and protective, but Netscape implied that D jumped the gun.
"Alert boxes showed in the middle of the night on visiting users pages with obscene language and things like 'omg!11! d1gg ru13s! i luv kev1n!' on them," Netscape.com developer Alex Rudloff told SecurityProNews.
"Luckily for us, we already had code on the way out the door to address this and similar possibilities. The matter was resolved in hours, if not minutes," he said. " We work hard, we work late -- but there are a ton of script kiddies in the world."
Rudloff denied that Netscape had ignored repeated warnings, but didn't speak specifically to one instance.
"A number of people, internal and external, have forwarded me XSS warnings and were responded to," he said. "There is rarely anything sent in that isn't sent in by a dozen other people, especially oversights like XSS."
Rudloff recalled receiving a link from an anchor to a submitted story that raised an XSS issue the Friday before the hack, but said the exploit had already been resolved. Other XSS warnings were given about search.netscape and channels.netscape, two URLs that were not directed to the new servers and thus "out of our control."
Feeling Netscape.com's XSS issues were being addressed, Rudloff forwarded the warnings about search.netscape and channels.netscape elsewhere, asking that the anchor close the link until a fix was in place. Rudloff is unaware if the anchor received his response.
"We do our best to read everything that comes our way and we respond where we can. There are 4 developers yet thousands of e-mails."
He said any hacker could easily get into contact with the Netscape developer team via email and instant messenger through a simple Google search.
"We're extremely transparent and open. Posting vague story submissions that get buried quickly by the community and/or anchors is probably the least effective way to do it though."
Netscape
Add to  Del.icio.us |  Digg |  Yahoo! My Web |  Furl
Get all the updates in RSS: 
View All Articles by SecurityProNews
About the Author:
SecurityProNews is a daily online and email publication focusing on internet security issues.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
