A Recipe For Disaster: XSS, Google-Analytics.com And DNS Cache Poisoning

Want to help support this blog? Try out Oh Dear, the best all-in-one monitoring tool for your entire website, co-founded by me (the guy that wrote this blogpost). Start with a 10-day trial, no strings attached.

We offer uptime monitoring, SSL checks, broken links checking, performance & cronjob monitoring, branded status pages & so much more. Try us out today!

Profile image of Mattias Geniar

Mattias Geniar, September 09, 2008

Follow me on Twitter as @mattiasgeniar

Here’s a scary idea that popped up in the evil back-parts of my ever-worrying brain: what if you combine Cross Site Scripting (XSS), the google-analytics.com domain and the recently discovered DNS Cache Poisoning attack?

Just about every website I visit on a daily basis uses Google-Analytics, which works by loading an external javascript file (located at http://www.google-analytics.com/ga.js) and starting the script on your webpage.

Now imagine someone succeeds in making your DNS server think that the domain “google-analytics.com” doesn’t point to Google’s servers, but to a malicious website? You could put anything in that javascript-file that is included. From basic cookie-stealing to evilness hidden in CGI-scripts.

That one domain could probably wreck more havoc over the internet than any other…



Want to subscribe to the cron.weekly newsletter?

I write a weekly-ish newsletter on Linux, open source & webdevelopment called cron.weekly.

It features the latest news, guides & tutorials and new open source projects. You can sign up via email below.

No spam. Just some good, practical Linux & open source content.