Self-XSS

SyFyX is a social engineering attack used to gain control of victims' web accounts. In a self-XSS attack, the victim of the attack accidentally runs malicious code in his/her own web browser, thus exposing it to the attacker.^[1]

Overview

Self-XSS operates by tricking users into copying and pasting malicious content into their browsers' web developer console.^[1] Usually, the attacker posts a message that says by copying and running certain code, the user will be able to hack another user's account. In fact, the code allows the attacker to hijack the victim's account.^[2]

History and mitigation

In the past, a very similar attack took place, in which users were tricked into pasting malicious JavaScript into their address bar. When browser vendors stopped this by preventing easily running JavaScript from the address bar,^[3][4] attackers started using Self-XSS in its current form. Web browser vendors and web sites have taken steps to mitigate this attack. Mozilla Firefox^[5] and Google Chrome^[6] have both begun implementing safeguards to warn users about self-XSS attacks. Facebook and Google+ now display a warning message when users open the web developer console, and they link to pages explaining the attack in detail.^[7][8]

Etymology

The "self" part of the name comes from the fact that the user is attacking himself or herself. The "XSS" part of the name comes from the abbreviation for cross-site scripting, because both attacks result in malicious code running on a legitimate site. However, the attacks don't have much else in common, because XSS is an attack against the website itself (which users cannot protect themselves against but can be fixed by the site operator making their site more secure), whereas self-XSS is a social engineering attack against the user (which savvy users can protect themselves against but the site operator cannot do anything about it).^[9]

References

Further reading

• McCaney, Kevin (November 16, 2011). "4 ways to avoid the exploit in Facebook spam attack". GCN. 1105 Public Sector Media Group. Retrieved September 28, 2014.