Security issue in Website Optimizer!

Google Logo bg:????????:Google.png

Image via Wikipedia

Google Website Optimizer Control Script is used by webmasters to reduce the loading times with the help of Google, a similar to Google Chrome frame in Internet explorer so that , yours website will load faster , the difference between Google Website Optimizer Control Script and Google Chrome frame  is that the former works in all the browsers and the later only for Internet explorer.On Tue, Dec 7, 2010 at 5:34 PM I got a letter from

Trevor ,Google Website Optimizer Team ,[email protected] to update the Google Website Optimizer Control Script in website.There are two ways to update your code. You can either stop current experiments, remove the old scripts, and create a new experiment, or you can update the code on your site directly.

  1. Creating a New Experiment
  2. Stop any currently running Website Optimizer experiments
  3. Remove all the Website Optimizer scripts from your site
  4. Create a new experiment as normal. New experiments are not vulnerable.

The content of the letter is as follows:

Dear Website Optimizer user,

We are writing to inform you of a potential security issue with Website Optimizer. By exploiting a vulnerability in the Website Optimizer Control Script, an attacker might be able to execute malicious code on your site using a Cross-Site Scripting (XSS) attack. This attack can only take place if a website or browser has already been compromised by a separate attack. While the immediate probability of this attack is low, we urge you to take action to protect your site.

We have fixed the bug, and all new experiments are not susceptible. However, any experiments you are currently running need to be updated to fix the bug on your site. Additionally, if you have any Website Optimizer scripts from paused or stopped experiments created before December 3, 2010, you will need to remove or update that code as well.

There are two ways to update your code. You can either stop current experiments, remove the old scripts, and create a new experiment, or you can update the code on your site directly. We strongly recommend creating a new experiment as it is the simpler method.

Creating a New Experiment
Stop any currently running Website Optimizer experiments
Remove all the Website Optimizer scripts from your site
Create a new experiment as normal. New experiments are not vulnerable.

Updating the Website Optimizer Control Script Directly
Locate the Control Script on your site. It looks like this:

A/B Test Control Script
<!– Google Website Optimizer Control Script –>
<script>
function utmx_section(){}function utmx(){}
(function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f(‘__utmx’),xx=f(‘__utmxx’),h=l.hash;
d.write(‘<sc’+’ript src="’+
‘http’+(l.protocol==’https:’?’s://ssl’:’://www’)+’.google-analytics.com’
+’/siteopt.js?v=1&utmxkey=’+k+’&utmx=’+(x?x:”)+’&utmxx=’+(xx?xx:”)+’&utmxtime=’
+new Date().valueOf()+(h?’&utmxhash=’+escape(h.substr(1)):”)+
‘" type="text/javascript" charset="utf-8"></sc’+’ript>’)})();
</script><script>utmx("url",’A/B’);</script>
<!– End of Google Website Optimizer Control Script –>

Multivariate Test Control Script
<!– Google Website Optimizer Control Script –>
<script>
function utmx_section(){}function utmx(){}
(function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f(‘__utmx’),xx=f(‘__utmxx’),h=l.hash;
d.write(‘<sc’+’ript src="’+
‘http’+(l.protocol==’https:’?’s://ssl’:’://www’)+’.google-analytics.com’
+’/siteopt.js?v=1&utmxkey=’+k+’&utmx=’+(x?x:”)+’&utmxx=’+(xx?xx:”)+’&utmxtime=’
+new Date().valueOf()+(h?’&utmxhash=’+escape(h.substr(1)):”)+
‘" type="text/javascript" charset="utf-8"></sc’+’ript>’)})();
</script>
<!– End of Google Website Optimizer Control Script –>

Locate the following in the Control Script: return c.substring(…
Modify the following line as shown:
BEFORE: return c.substring(i+n.length+1,j<0?c.length:j)
FIXED: return escape(c.substring(i+n.length+1,j<0?c.length:j))
Make sure to include the final closing parenthesis �)�

Fixed A/B Control Script
<!– Google Website Optimizer Control Script –>
<script>
function utmx_section(){}function utmx(){} (function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){ if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);
return escape(c.substring(i+n.length+1,j<0?c.length:j))}}}
var x=f(‘__utmx’),xx=f(‘__utmxx’),h=l.hash; d.write(‘<sc’+’ript src="’+
‘http’+(l.protocol==’https:’?’s://ssl’:’://www’)+’.google-analytics.com’
+’/siteopt.js?v=1&utmxkey=’+k+’&utmx=’+(x?x:”)+’&utmxx=’+(xx?xx:”)+’&utmxtime=’
+new Date().valueOf()+(h?’&utmxhash=’+escape(h.substr(1)):”)+
‘" type="text/javascript" charset="utf-8"></sc’+’ript>’)})();
</script><script>utmx("url",’A/B’);
</script>
<!– End of Google Website Optimizer Control Script –>

Fixed Multivariate Control Script
<!– Google Website Optimizer Control Script –>
<script>
function utmx_section(){}function utmx(){}
(function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);
return escape(c.substring(i+n.length+1,j<0?c.length:j))}}}
var x=f(‘__utmx’),xx=f(‘__utmxx’),h=l.hash; d.write(‘<sc’+’ript src="’+
‘http’+(l.protocol==’https:’?’s://ssl’:’://www’)+’.google-analytics.com’
+’/siteopt.js?v=1&utmxkey=’+k+’&utmx=’+(x?x:”)+’&utmxx=’+(xx?xx:”)+’&utmxtime=’
+new Date().valueOf()+(h?’&utmxhash=’+escape(h.substr(1)):”)+
‘" type="text/javascript" charset="utf-8"></sc’+’ript>’)})();
</script>
<!– End of Google Website Optimizer Control Script –>

Note that the k=XXXXXXXXX line in the above Control Script examples is a placeholder.

Your experiment will continue as normal after you�ve made this update. There�s no need to pause or restart the experiment.

We�re committed to keeping Website Optimizer secure, and we�re deeply sorry for this issue. We will continue to work hard to prevent future vulnerabilities.

Sincerely,
Trevor
Google Website Optimizer Team

Follow ittechs on Twitter

Enhanced by Zemanta

Leave a Reply

Your email address will not be published. Required fields are marked *