Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

#1 CSRF Is A Vulnerability In All Browsers

homakov.blogspot.com

Post reply on HN
Print view View original

131–140 of 256 posts

Re: #1 CSRF Is A Vulnerability In All Browsers

#131

Post by flurdy »

redthrowaway wrote: post #112
inchcombec wrote: post #80

Earlier quoted context omitted.

That is TERRIBLE advice. I don't know exactly what you mean by 'friendly hacking' but ANY exploitation of a website vulnerability without that site's permission would be a crime pretty much anywhere; even if it isn't malicious. It would be far from the first time that an administrator or owner didn't understand that the person was trying to help or just didn't really want to deal with it and it then just ended up bei…

Not much different from the recent Github hack, really.

Same guy :)

Re: #1 CSRF Is A Vulnerability In All Browsers

#132

Post by jasonkeene »

nbpoole wrote: post #125
jasonkeene wrote: post #123

Earlier quoted context omitted.

Humm.. I'm thinking you could write a middleware that checks for Referer over https and if not set, go ahead and set it to https://yourdomain.com That would allow you to continue to use CSRF middleware for the nonce check (just make sure yours is before theirs).

Except an attacker can strip a referer header: if you fail open like that, you leave yourself open to attack. See http://blog.kotowicz.net/2011/10/stripping-referrer-for-fun-... for examples

In order to exploit this an attacker would need to be MITM on the network or on a subdomain by setting a wildcard cookie. The site would still keep the nonce check. I don't see any way around this without poking a tiny hole in the CSRF protection. Guess you gotta weigh the cost/benefit.

Re: #1 CSRF Is A Vulnerability In All Browsers

#133

Post by marquis »

elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

I'm still logged into Gmail on Chrome, so this is an specific browser issue?

Re: #1 CSRF Is A Vulnerability In All Browsers

#134

Post by driverdan »

Zirro wrote: post #60

Am I correct in interpreting that the proposed fix would the be the same as the functionality provided by RequestPolicy (which he mentions in the post)? I've used it for quite a while now, and although it works well for me as a power-user (who is concerned about security), I can't imagine the confusion and pain a user will feel despite the message suggested. Blocking resources loaded over separate domains breaks a lo…

As my other comment highlighted, disabling 3rd party cookies will prevent most CSRF. As an added bonus it will also increase your privacy by preventing some (but not all) cross domain tracking.

Re: #1 CSRF Is A Vulnerability In All Browsers

#135

Post by streptomycin »

seanalltogether wrote: post #26

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well? https://mail.google.com/mail/u/0/?logout

If Google would prefer that any random website can't log its users out of its services, then yes, it's a CSRF vulnerability.

Re: #1 CSRF Is A Vulnerability In All Browsers

#136

Post by divtxt »

vectorpush wrote: post #70

it took me a long time to understand the point behind CSR (cross-site requests) and CRSF fully enough to find them EXTREMELY malicious. I think this is a very important line. The sense I get around most of my colleagues is that CSRF exploits are only something "bad programmers" get wrong. Of course, they're all rockstars who've never been exploited (yet/AFATK) so it's not like they need to spend a weekend or five pag…

CSRF is like a kafka-esque joke.

Here's my take away from every CSRF article:

A malicious site will load your site in an iframe, fill in your form and post it. Fixing it requires some a token in your form, but I can see you don't understand how an extra hidden field in your form will make a difference so you're clearly not going to handle it correctly. You're screwed. Go home.

As far as I can tell, CSRF should have existed since javascript & frames. How have the browser vendors not fixed such a huge insecure-by-design flaw?

Re: #1 CSRF Is A Vulnerability In All Browsers

#137

Post by yuliyp »

txt wrote: post #68

Adding a extra token for protection against CSRF attacks will only work if is changed on each request. Some of the biggest sites out there do not do this. I know of one site in particular (I won't name it, but its HUGE) that generates a unique token every time a user logs in. The token doesn't change until the user logs out even if the user closes the browser and doesn't go back to the site for a week, the token will…

Did you consider reporting it? Many such "huge" sites have bug bounty/white hat programs.

Re: #1 CSRF Is A Vulnerability In All Browsers

#138

Post by yuliyp »

txt wrote: post #68

Adding a extra token for protection against CSRF attacks will only work if is changed on each request. Some of the biggest sites out there do not do this. I know of one site in particular (I won't name it, but its HUGE) that generates a unique token every time a user logs in. The token doesn't change until the user logs out even if the user closes the browser and doesn't go back to the site for a week, the token will…

Did you consider reporting it? Many such "huge" sites have bug bounty/white hat programs.

Re: #1 CSRF Is A Vulnerability In All Browsers

#139

Post by ricardobeat »

Zirro wrote: post #60

Am I correct in interpreting that the proposed fix would the be the same as the functionality provided by RequestPolicy (which he mentions in the post)? I've used it for quite a while now, and although it works well for me as a power-user (who is concerned about security), I can't imagine the confusion and pain a user will feel despite the message suggested. Blocking resources loaded over separate domains breaks a lo…

No need to go that far. The X-Frame-Options: SAMEORIGIN header, supported by all major browsers, can prevent the majority of these attacks (unwanted GET requests in the background).

https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_respons...

Other than that, it should be hammered into developer's heads that GET should not have side effects.

Re: #1 CSRF Is A Vulnerability In All Browsers

#140

Post by [deleted] »

citricsquid wrote: post #40

Maybe this is a good time to ask: I found an xss vulnerability in a website that can be used to cause noticeable problems (enough that fixing it should be a priority) so I contacted the developers behind the site and informed them what caused it, how to fix and an example of it in practice and why it's bad: they've done nothing in over a month. What do I do? I guess the answer is "forget it", but I feel like if I don…

[deleted]
Post reply on HN