[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2652
  • Last Modified:

How dangerous is <input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----

Hi,

In the source code of a free storage hosting site I noticed a code to be invoked when pressing a javascript button. There is no reason to the action to be encrypted, so I think a lot about malicious coding, worms, and so on...

So my question is: could below code (starting and finishing lines reproduced) carry malicious code inside it, as executables, spyware, worms?
 
<input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----MIIHVwYJKoZIhvcNAQcEoIIHSDCCB0QCAQExggEwMIIBLAIBADCBlDCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRY ...                             ........ several lines, around 20 ........
k4wmuKk/UZw7fV6+8wZOGr0eI8ScnVuFysSEAZ4BhhiGV4Pgyq5A5VvQ78HZg2N6//+GudczKzx9A0jZ1JX9V1uHxkBClK0jnXw=-----END PKCS7-----">

Thank you!
0
Jose Parrot
Asked:
Jose Parrot
  • 2
  • 2
2 Solutions
 
Harisha M GCommented:
Hi, there is no need for this to be encrypted, as you are aware.

The value cannot be decrypted unless its format or the decrypter is known. What action is taken when you click the button ? ( I mean, in the code, what is written ? )

Does it manipulate this information in some way ? If so, I hope we can track that.

---
Harish
0
 
Jose ParrotGraphics ExpertAuthor Commented:
Thanks, Harish,

The action is to start the upload of a selected file in the user's computer to the free storage site, at a folder assigned to the user.

As soon I asked the site owner what was the purpose of such code, the web page was modified, and the code deleted. Unfortunately I didn't captured the whole page source, just the tag.

Actually I would like to track the following actions after pressing the button, as you suggest, mainly because the owner of such site posted a question here in EE, asking the experts to upload a file to test the interactivity.

Free storage area + a site with no banners or advertising popups or sponsors + www.something.nu + encrypted code = suspicious thing. If the source is edited after my question = much more suspicious. But I don't want to accuse someone based only in assumptions that can be wrong or mere paranoia.

I'm trying to find, in temporary files, the former page. If I find it, I'll post a new question. By now I will be happy if I can understand how dangerous, in potential and generalizing, could be specifically this kind of code (input type="hidden" name="encrypted" value="-----BEGIN PKCS7---) and something about the mechanism of installing, by using such code, malicious programs in the user's PC.

Jose
0
 
Harisha M GCommented:
It won't do anything to the system, provided you use a secure browser such as IE or FF.

The worst it can cause is to put a dialler software, or a malware. To be sure that it has not done anything, run HijackThis.
0
 
ahoffmannCommented:
the value= attribute could contain anything, even malicious code for whatever you could imagine
But as long as you don't have enabled any active scripting in your browser, it's just data of the web page, nothing to think about, not a security problem anyhow.
0
 
Jose ParrotGraphics ExpertAuthor Commented:
Thanks, guys!
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now