UPDATED: 1/30/06 Response from Author
"Just to inform you that the malicious code mentioned to you was actually partly research for the paper. If you take a look at the latest version (with lynx if you like), I now refer to the clipboard issue in issue 3 (this was introduced in 1.2.0 of my paper. The code that was previously included in the page simply logged a 404 in my error logs for each success, I'm intending to run these logs through a log processor so that I can get a better understanding of vulnerable IE versions still in the wild and whether there is a significant variation in success dependent on the carrier web site.

To clarify, the code itself has been removed. Once the balloon went up, as it were there was no further benefit in keeping it there, since any future results would be quickly be skewed by publicity.

From what I understand, the clipboard issue only affects IE. The point of the paper is that legitimate features can be used in an unorthodox manner and that these features carry far more risk than is currently perceived by many people including those in the industry. XSS attacks aren't just about stealing cookies. IMO a feature such as this, which was flagged up in 2002 should by now have been dealt with and yet it has been allowed to remain.

I make the point in my paper that really it would be beneficial for far more granular security to be put in place within browsers which should include the use of PKI signing of Javascript code. This would allow browsers to correctly identify legitimate Javascript introduced by the developer as opposed to rogue code introduced via a XSS attacks. The overall risks highlighted in the paper are faced by every single one of us on a daily basis and therefore need to be better understood." - Tim

1/29/06 IMPORTANT UPDATE: A viewer has brought to my attention that the site linked in this story contains malicious javascript using a well known vulnerability to copy clipboard data and send it to an attackers site. For this reason I have removed the clickable link. If you want to read more about this article be warned of the URl that you are going to visit. - CGISecurity Staff

"Some months back, a colleague and I were kicking around some ideas for a cross platform XSS born virus[1]. He ended up writing a paper on it and I didn't. Whilst it is common to see the issue of Javascript injection on the various security oriented mailing lists, there are issues I've not seen much mention of, this paper seeks to rectify that." - Tim Brown

Article Link (View with Caution): http://www.nth-dimension.org.uk/news/entry.php?e=156579087