WHID 2008-02: Italian Bank's XSS Opportunity Seized by Fraudsters
It has been a while since a phishing scam using XSS vulnerability found its way to the Web Hacking Incidents database (SunTrust, WHID 2004-11). The current incident is a good example of what does and does not get into our database: XSS vulnerabilities in public web sites are discovered daily and reported in sites such as XSSed, however most of these vulnerabilities are not included in WHID for lack of public interest. The current incident is different since the vulnerability is known to be exploited by attackers, moving it from the realm of technical interest to the realm of a real problem.
Additional information:
- Italian Bank's XSS Opportunity Seized by Fraudsters [NetCraft, Jan 8 2008]
Attack Method:
Incident Outcome:
