1

We recently had a scenario in which an iframe snippet on a server A was pointing to url on server B. There were some malwares being installed by server A on some clients. Can this iframe be the cause. As in hacker injected his url in the iframe's src. What can be the alternatives to iframe etc.

4 Answers 4

4

Most likely you experienced XSS

2

If a hacker is able to change the URL an iframe points to on your site then the iframe is not the problem, your code is.

Any web site could serve up malware, but you have indicated that the hacker has attacked your site and changed the src attribute of the iframe, not the site serving the iframe contents. Even if you replaced an iframe with something else the fact that an attacker has managed to get to the data behind your web site used to generate the page means that they could not limit themselves to iframes, but embed other tactics, such as a redirect, or a hidden link which is clicked by javascript or any other type of common nasty.

2
  • so you mean to say they got an access to server A ?
    – Rakesh
    Commented Jul 22, 2009 at 9:13
  • Well that's what you said - (the) "hacker injected his url in the iframe's src". If, as you say, the src attribute on the iframe pointed to an attackers site then I'd look to your code
    – blowdart
    Commented Jul 22, 2009 at 9:15
2

Generally IFrame whose content comes from a different domain cannot access the DOM of the parent web site - due to cross domain scripting restrictions. There were lots of bugs involving browsers not implementing such restrictions properly, so an out-of-date client browser might be the cause.

1
  • As much a possibility as anything else.
    – EFraim
    Commented Jul 22, 2009 at 9:11
0

Unless you're running code inside of the iFrame, which you really shouldn't be, it would be a good idea to disable that iFrame from running any code.

2
  • Unsure why I was marked down, as this is extremely sound advice. He didn't mention what languages he was using so I really couldn't tell him what to do.
    – Sneakyness
    Commented Jul 22, 2009 at 11:48
  • 1
    AFAIK, there is no reliable way for a host page to tell the browser, "do not run any JavaScript in this iframe". HTML5 defines a sandbox attribute that does this (and some other stuff), but many browsers that people are running these days (late Nov 2012) do not support this yet. Maybe you should explain what you mean by disabling code from running. If I'm reading you correctly, there is no practical way to do that today. Commented Nov 25, 2012 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.