Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

#1 CSRF Is A Vulnerability In All Browsers

homakov.blogspot.com

Post reply on HN
Print view View original

31–40 of 256 posts

Re: #1 CSRF Is A Vulnerability In All Browsers

#31

Post by homakov »

spindritf wrote: post #19
elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

There's an info now at the top of the post > To stir up your interest - check any google service e.g. gmail, you are logged out. Great hook btw. Even more impressively, I have all js on his blog blocked through NoScript and it still worked.

I don't run any JS. It's just an image:D

Re: #1 CSRF Is A Vulnerability In All Browsers

#33

Post by homakov »

seanalltogether wrote: post #26

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well? https://mail.google.com/mail/u/0/?logout

It has nothing to do with future posts, I repeat...

Re: #1 CSRF Is A Vulnerability In All Browsers

#34

Post by rdl »

homakov wrote: post #28
rdl wrote: post #20

You realize you could be monetizing these security vulnerabilities, right?

how? If I report nobody pays even 'thank you'.

Fuck reporting it, unless you're contractually obligated because they've retained you (or, if it's an open source project you like, and want to support). If vendors won't even listen to you, clearly they don't value your time or their product, or their customers.

You can sell security vulnerabilities to a variety of parties. If you want introductions, email me.

Some people view this as "wrong" in some ethical way, but meh. Money is good -- it can be exchanged for valuable goods and services. There have been a lot of arguments for "responsible disclosure", "anti-sec", "full disclosure", etc. over the years.

I'd draw the line at blackhatting yourself with the vulnerability, but just selling the info is legal. Generally, security companies are buyers, and their clients tend to be governments, generally western (USA).

Re: #1 CSRF Is A Vulnerability In All Browsers

#35

Post by sounds »

rosser wrote: post #5
akavlie wrote: post #2

For those who didn't see the recent kerfuffle: This guy recently found and demonstrated a major Rails exploit on github. He seems to know a thing or two about security exploits.

Clarification: he didn't recently find the exploit. He's been making noises about it for a very long time and being ignored, so he took the (dubious, to some) step of using the exploit publicly and loudly, to draw attention to the problem.

Let's be fair to homakov:

He used the exploit publicly and loudly (full disclosure to almost all affected parties) by doing a relatively harmless change to _rails_ _master_ on github.

If his actions should be called an attack, then it was highly targeted - at the people who could fix it - to get their attention.

Re: #1 CSRF Is A Vulnerability In All Browsers

#37

Post by jiggy2011 »

CSRF is a bit of a pain to work around but how much of a problem is it in the wild?

Most sites where this could do real damage (and have real gains for the attacker), banks etc are going to be well protected.

You could use it to comment spam a blog but that's going to be a crapshoot. Guessing which blog people are logged into etc, you would need very targeted attacks.

Sure , signing out of google is annoying but if you have lastpass or similar signing back in is pretty frictionless.

Re: #1 CSRF Is A Vulnerability In All Browsers

#38

Post by jiggy2011 »

homakov wrote: post #31
spindritf wrote: post #19

Earlier quoted context omitted.

There's an info now at the top of the post > To stir up your interest - check any google service e.g. gmail, you are logged out. Great hook btw. Even more impressively, I have all js on his blog blocked through NoScript and it still worked.

I don't run any JS. It's just an image:D

If the target site treats GET and POST identically then that could still be a problem.

Just have

http://targetsite.php/form?submit=1&data=gjoprgrger />

Re: #1 CSRF Is A Vulnerability In All Browsers

#39

Post by ketralnis »

seanalltogether wrote: post #26

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well? https://mail.google.com/mail/u/0/?logout

I interpret CSRF (cross-site request forgery) to be different from XSS (cross-site scripting). This particular vulnerability is indeed a CSRF, but not an XSS which is what it sounds like you're confusing it for.

Re: #1 CSRF Is A Vulnerability In All Browsers

#40

Post by citricsquid »

Maybe this is a good time to ask:

I found an xss vulnerability in a website that can be used to cause noticeable problems (enough that fixing it should be a priority) so I contacted the developers behind the site and informed them what caused it, how to fix and an example of it in practice and why it's bad: they've done nothing in over a month. What do I do?

I guess the answer is "forget it", but I feel like if I don't do anything someone malicious will discover the issue and cause harm to users of the website...

Post reply on HN