[In]security

The CIA gets played:

In an age where JavaScript is so ubiquitous that some websites won't even load if you don't enable in your browser, cross-site scripting hacks are everywhere - letting malicious or merely mischievous hacker create links that have some very unintended consequences on websites that are not careful to keep from executing other people's code.
Most are run-of-the-mill and hardly worth writing about, but reader Harry Sintonen writes in with a vulnerability on the CIA's site that THREAT LEVEL can't resist.
For those of you who don't see it after clicking through, notice that the links lead to the CIA's site, but displays a recent THREAT LEVEL story. Here the CIA search box fails to rip out characters that will run as a script when the site tries to process the search query.
It's a pretty common error. Recently, spammers found a similar bug in Wired.com's search engine and used it to drive up their sites' placement in search engines. Dancho Danchev kindly reported it to us and it's since been fixed..
Still, I am now tempted to add the CIA to the list of media outlets I have written for. And HS's other demo link is pretty funny, as well. Sintonen has a list of other vulns he found here (.txt).
And, by the way, this little hack does not work if you are using Firefox along with the NoScript plug-in.