Websites that accidentally distribute rogue code could find it harder to undo the damage if attackers exploit widespread browser support for HTML5 local storage and an increasing tendency for heavy users of Web apps never to close their browser.
If browsers don't provide a mechanism for websites to securely recover from certain XSS (cross-site scripting) attacks, the attacks could become invincible and the site at the origin of the attack remain compromised indefinitely, warned vulnerability researcher and Google security engineer Michal Zalewski in a blog posting on Saturday.
[ The Web browser is your portal to the world -- as well as the conduit that lets in many security threats. InfoWorld's expert contributors show you how to secure your Web browsers in this "Web Browser Security Deep Dive" PDF guide. ]
A normal response to XSS attacks is to patch the vulnerability, invalidate session cookies so that everyone is forced to re-authenticate, and optionally force a password change. But this is not enough, because, according to Zalewski, once compromised a Web origin can stay tainted indefinitely.
"At the very minimum, the attacker is in full control for as long as the user keeps the once-affected website open in any browser window; with the advent of portable computers, it is not uncommon for users to keep a single commonly used website open for weeks," he said. "During that period, there is nothing the legitimate owner of the site can do -- and in fact, there is no robust way to gauge if the infection is still going on."
In essence, there is no way for websites to ensure that their users are no longer affected by an XSS attack. Still, one would be inclined to think that such an attack would stop at some point without the website's intervention, such as when closing the tab or the browser, but as it turns out, that's not necessarily the case.
There are several methods that attackers can use to extend their hold on a compromised origin pretty much indefinitely, according to Zalewski.
If Facebook were targeted by such an exploit, then given the way users constantly open new pages from the site, or external websites carrying Facebook "Like" buttons, the compromise could go on for as long as one of those pages remains open.