The Lazy Genius

Security News & Brain Dumps from Xavier Ashe, a Bit9 Client Partner

Stealing Search Engine Queries with JavaScript

Posted by Xavier Ashe on October 1, 2006

SPI Labs has discovered a practical method of using JavaScript to
detect the search queries a user has entered into arbitrary search
engines. All the code needed to steal a user's search queries is
written in JavaScript and uses Cascading Style Sheets (CSS). This code
could be embedded into any website either by the website owner or by a
malicious third party through a Cross-site Scripting (XSS) attack.
There it would harvest information about every visitor to that site.

Possible uses:

-HMO's website could check if a visitor has been searching other sites about cancer, cancer treatments, or drug rehab centers.

-Advertising networks could gather information about which
topics someone is interested based on their search history and use that
to echance their customer databases.

-Government websites could see if a visitor has been searching for bomb-making instructions.

SPI has published a whitepaper about this technique and has also
release proof of concept code that will steal search engine queries.
Works solid in Firefox, and IE support is a little shaky on multi word
queries.

Whitepaper: http://www.spidynamics.com/assets/documents/JS_SearchQueryTheft.pdf

Found on Full Disclosure.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: