GNUCITIZEN

Steven says:

I think I am actually going to write something about this soon as I keep hearing it over and over. There isn’t really an “iframe” exploit. Someone might make a virtually-invisible iframe reference to another page that houses exploit code, however, this is not an exploit with iframes. If you’re running unpatched software (and usually as an administrator) , that is why you got owned. Te iframe is simply how they pulled in the exploit code from the third party site.

Steven says:

Yep I am very familiar with that as iframe’s have been used for exploits for years now. I just find it funny that the same old things get recycled and treated as new. I guess it’s good for those that might have missed it or didn’t get it before.

rootkid says:

Actually, it’s not necessarily the webserver that has to be compromised/infected. A proxy server would certainly be a more powerful attack base. Actually, I developed an “in-line” browser exploit years ago, which could be deployed in an internal network, working as a proxy for all outgoing http request (if needed, after executing a MITM attack to redirect the network stream). I injected the exploit only once for a certain (or all) websites, that way the user or administrator could be compromised even if he/she only surfed “trustworthy” sites. Of course, compromising a proxy is alway a major security breach, but I think injecting malicious mobile code certainly multiplies the amount of attackable clients. Of course, that way the attacker does not have to make use of an IFRAME anymore.
I wouldn’t be surprised if proxy servers become more and more the aim of large-scale attacks very soon.