"Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc

I hope he's alerted the websites involved before publicly releasing the vulnerabilities like this. This guy has serious potential, he's obviously very smart, I wouldn't want to see him fall into the "bad" side of internet security.

Kudos for finding them, I hope you reported them.

Re: "Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc

#5

Post by jmvoodoo » Tue, Apr 03, 2012, 4:00 AM UTC

Isn't this problem also solved by disabling 3rd party cookies? This is a feature already in the browser. I've used it for months and the only thing that I've noticed not working (i.e. the only impact on me as a user) is that integrated disqus forums on some blogs don't work.

Re: "Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc

#6

Post by tptacek » Tue, Apr 03, 2012, 4:01 AM UTC

jmvoodoo wrote: post #5

Isn't this problem also solved by disabling 3rd party cookies? This is a feature already in the browser. I've used it for months and the only thing that I've noticed not working (i.e. the only impact on me as a user) is that integrated disqus forums on some blogs don't work.

No, disabling 3rd party cookies does not stop CSRF.

Re: "Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc

#7

Post by tptacek » Tue, Apr 03, 2012, 4:01 AM UTC

Previous discussion: http://news.ycombinator.com/item?id=3778158

Re: "Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc

#8

Post by jmvoodoo » Tue, Apr 03, 2012, 4:05 AM UTC

tptacek wrote: post #6

jmvoodoo wrote: post #5

Isn't this problem also solved by disabling 3rd party cookies? This is a feature already in the browser. I've used it for months and the only thing that I've noticed not working (i.e. the only impact on me as a user) is that integrated disqus forums on some blogs don't work.

No, disabling 3rd party cookies does not stop CSRF.

Can you explain? My understanding was that cookies will not be sent in these attacks (I validated this only testing some approaches, namely doubleclick and other ad embeds). Without cookies, how would the CSRF attack access my account? Or have I missed something obvious?

Re: "Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc

#9

Post by drivebyacct2 » Tue, Apr 03, 2012, 4:10 AM UTC

darxius wrote: post #4

I hope he's alerted the websites involved before publicly releasing the vulnerabilities like this. This guy has serious potential, he's obviously very smart, I wouldn't want to see him fall into the "bad" side of internet security. Kudos for finding them, I hope you reported them.

If you read it, you'd know he reported most of them. I'm betting he reported all of them (as he did before).

Re: "Hacking" Skrill/Moneybookers, Bitbucket, Github, Heroku etc

#10

Post by eurleif » Tue, Apr 03, 2012, 4:20 AM UTC

jmvoodoo wrote: post #8

tptacek wrote: post #6

Earlier quoted context omitted.

No, disabling 3rd party cookies does not stop CSRF.

Can you explain? My understanding was that cookies will not be sent in these attacks (I validated this only testing some approaches, namely doubleclick and other ad embeds). Without cookies, how would the CSRF attack access my account? Or have I missed something obvious?

Disabling third party cookies disables cookies in certain contexts, like when loading images and frames from another domain, but there are other ways to perform a CSRF attack. A link or form that doesn't target a frame would still work.