RSS

Security issue in Website Optimizer

07 Dec

SEO Services Provider

Dear SEO Friends,

Today I received one below email from Google Website Optimizer:
Dear Website Optimizer user,

We are writing to inform you of a potential security issue with Website Optimizer. By exploiting a vulnerability in the Website Optimizer Control Script, an attacker might be able to execute malicious code on your site using a Cross-Site Scripting (XSS) attack. This attack can only take place if a website or browser has already been compromised by a separate attack. While the immediate probability of this attack is low, we urge you to take action to protect your site.

We have fixed the bug, and all new experiments are not susceptible. However, any experiments you are currently running need to be updated to fix the bug on your site. Additionally, if you have any Website Optimizer scripts from paused or stopped experiments created before December 3, 2010, you will need to remove or update that code as well.

There are two ways to update your code. You can either stop current experiments, remove the old scripts, and create a new experiment, or you can update the code on your site directly. We strongly recommend creating a new experiment as it is the simpler method.

Creating a New Experiment

1. Stop any currently running Website Optimizer experiments
2. Remove all the Website Optimizer scripts from your site
3. Create a new experiment as normal. New experiments are not vulnerable.

Updating the Website Optimizer Control Script Directly

1. Locate the Control Script on your site. It looks like this:

A/B Test Control Script

function utmx_section(){}function utmx(){}
(function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash;
d.write('’)})();
utmx(“url”,’A/B’);

Multivariate Test Control Script

function utmx_section(){}function utmx(){}
(function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);return c.substring(i+n.
length+1,j<0?c.length:j)}}}var x=f('__utmx'),xx=f('__utmxx'),h=l.hash;
d.write('’)})();

2. Locate the following in the Control Script: return c.substring(…
3. Modify the following line as shown:
BEFORE: return c.substring(i+n.length+1,j<0?c.length:j)
FIXED: return escape(c.substring(i+n.length+1,j<0?c.length:j))
Make sure to include the final closing parenthesis “)”

Fixed A/B Control Script

function utmx_section(){}function utmx(){} (function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){ if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);
return escape(c.substring(i+n.length+1,j<0?c.length:j))}}}
var x=f('__utmx'),xx=f('__utmxx'),h=l.hash; d.write('’)})();
utmx(“url”,’A/B’);

Fixed Multivariate Control Script

function utmx_section(){}function utmx(){}
(function(){var k=’XXXXXXXXXX’,d=document,l=d.location,c=d.cookie;function f(n){
if(c){var i=c.indexOf(n+’=’);if(i>-1){var j=c.indexOf(‘;’,i);
return escape(c.substring(i+n.length+1,j<0?c.length:j))}}}
var x=f('__utmx'),xx=f('__utmxx'),h=l.hash; d.write('’)})();

Note that the k=XXXXXXXXX line in the above Control Script examples is a placeholder.

Your experiment will continue as normal after you’ve made this update. There’s no need to pause or restart the experiment.

We’re committed to keeping Website Optimizer secure, and we’re deeply sorry for this issue. We will continue to work hard to prevent future vulnerabilities.

Sincerely,
Trevor
Google Website Optimizer Team

Email Preferences: You have received this mandatory email service announcement to update you about important changes to your Google Website Optimizer product or account.

Copyright 2010. Google is a trademark of Google Inc. All other company and product names may be trademarks of the respective companies with which they are associated.

Email from: websiteoptimizer-noreply@google.com

 

6 responses to “Security issue in Website Optimizer

  1. P.A.Manoj

    December 13, 2010 at 1:19 PM

    I am looking for Google Adwords Certification can you give me details about it

     
  2. Shankhadip

    December 15, 2010 at 7:27 AM

    This is the mail many of the webmaster around the country got. I know 7-8 person personally who got the same kind of email. SO nothing to be worried about and its good for u also.

     
  3. Peter

    February 15, 2011 at 8:55 AM

    Thanks for sharing these precious information with us..I appreciate it

     
  4. SEO

    March 17, 2011 at 7:34 AM

    Thanks for sharing the information, but i didnt get for what purpose we have to use this code.

     
  5. Dot Net Web development

    April 12, 2011 at 9:29 PM

    It is really great to visit here and read your blog.
    you shared very good knowledge.

     
  6. brettdeanwilliam

    October 21, 2011 at 8:50 AM

    SEO teds for Search Engine Optimization and it is used for get top rank in the major search engine like google and being and yahoo.

     

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: