#1 CSRF Is A Vulnerability In All Browsers • Hacker News Board

Re: #1 CSRF Is A Vulnerability In All Browsers

#51

Post by seanp2k2 » Fri, Mar 30, 2012, 10:04 PM UTC

rdl wrote: post #20

You realize you could be monetizing these security vulnerabilities, right?

People that do stuff like that need to find another industry. IT is not for them. We're nice people, generally. Maybe try finance or real estate or lobbying or health care or defence work.

Re: #1 CSRF Is A Vulnerability In All Browsers

#52

Post by gibybo » Fri, Mar 30, 2012, 10:05 PM UTC

seanalltogether wrote: post #26

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well? https://mail.google.com/mail/u/0/?logout

Cross site request forgery is separate from cross site scripting. He is not clamming to have done any cross site scripting. Secure sites generally require a token to perform any state changing effects, it's just odd that Google doesn't require it for logging out.

Facebook uses http://facebook.com/logout.php to log you out, but clicking that link won't do it.

Re: #1 CSRF Is A Vulnerability In All Browsers

#53

Post by postfuturist » Fri, Mar 30, 2012, 10:06 PM UTC

Google allows a logout from a GET request, on Chrome of all browsers? Is there a way to run browser tabs completely sandboxed regarding cookies/auth? (private browsing mode and running different browsers is a bit too clunky)

Re: #1 CSRF Is A Vulnerability In All Browsers

#54

Post by gibybo » Fri, Mar 30, 2012, 10:06 PM UTC

jiggy2011 wrote: post #37

CSRF is a bit of a pain to work around but how much of a problem is it in the wild? Most sites where this could do real damage (and have real gains for the attacker), banks etc are going to be well protected. You could use it to comment spam a blog but that's going to be a crapshoot. Guessing which blog people are logged into etc, you would need very targeted attacks. Sure , signing out of google is annoying but if y…

Gmail has had more serious CSRF vulnerabilities in the past - you could use it to download the entire address book of anyone who visited your site.

Re: #1 CSRF Is A Vulnerability In All Browsers

#55

Post by LewisCr » Fri, Mar 30, 2012, 10:07 PM UTC

homakov wrote: post #8

elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

hm yep. should I hide that thing? hm.. Sorry guys in advance.

Works on Android Dolphin

Re: #1 CSRF Is A Vulnerability In All Browsers

#56

Post by gibybo » Fri, Mar 30, 2012, 10:07 PM UTC

ck2 wrote: post #44

Don't allow actions through GET, always use POST.

That doesn't solve it because the attacker can just create a and auto submit it with js (or make a translucent submit button that is the size of the entire page if you have JS disabled).

Re: #1 CSRF Is A Vulnerability In All Browsers

#57

Post by kaolinite » Fri, Mar 30, 2012, 10:08 PM UTC

This is a problem with app developers, not browser makers. Applications should follow the HTTP spec and not do any persistent changes via GET.

The "I can log you out of Facebook/etc" trick is one of those techniques that script-kiddies love using on forums.

Re: #1 CSRF Is A Vulnerability In All Browsers

#58

Post by brian_peiris » Fri, Mar 30, 2012, 10:09 PM UTC

Here's Google's reply to this particular "vulnerability": http://www.google.com/about/company/rewardprogram.html#logou...

Re: #1 CSRF Is A Vulnerability In All Browsers

#59

Post by rdl » Fri, Mar 30, 2012, 10:09 PM UTC

seanp2k2 wrote: post #51

rdl wrote: post #20

You realize you could be monetizing these security vulnerabilities, right?

People that do stuff like that need to find another industry. IT is not for them. We're nice people, generally. Maybe try finance or real estate or lobbying or health care or defence work.

I agree the world would be better if it were just nice people being nice, but IT security has become defense, and is an increasing part of defense. Governments are buying.

I don't see a huge moral difference between smart hacker with $0 (publishing 0-day for the lulz) and smart hacker with $250k (selling vuln to a defense contractor).

Re: #1 CSRF Is A Vulnerability In All Browsers

#60

Post by Zirro » Fri, Mar 30, 2012, 10:09 PM UTC

Am I correct in interpreting that the proposed fix would the be the same as the functionality provided by RequestPolicy (which he mentions in the post)? I've used it for quite a while now, and although it works well for me as a power-user (who is concerned about security), I can't imagine the confusion and pain a user will feel despite the message suggested.

Blocking resources loaded over separate domains breaks a lot of sites today. Few popular sites keep everything under the same domain (CDN´s, commentsystems, captchas and Facebook/Google/Twitter-resources, for example). http://www.memebase.com is probably the worst "offender" I've come across. Hacker News isn't one of them, which I'm happy to see.

Although if this was implemented I could see a lot of sites moving quickly to remedy this, reducing the alerts. It'd still be a pretty hard transition-period, though.

Want to see how much would break today (and if the fix would work for the average user)? Try: https://www.requestpolicy.com