Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

#1 CSRF Is A Vulnerability In All Browsers

homakov.blogspot.com

Post reply on HN
Print view View original

41–50 of 256 posts

Re: #1 CSRF Is A Vulnerability In All Browsers

#41

Post by homakov »

jiggy2011 wrote: post #37

CSRF is a bit of a pain to work around but how much of a problem is it in the wild? Most sites where this could do real damage (and have real gains for the attacker), banks etc are going to be well protected. You could use it to comment spam a blog but that's going to be a crapshoot. Guessing which blog people are logged into etc, you would need very targeted attacks. Sure , signing out of google is annoying but if y…

>Most sites where this could do real damage (and have real gains for the attacker), banks etc are going to be well protected.

You think so. In "the wild" even serious systems are vulnerable #OpApril1

Re: #1 CSRF Is A Vulnerability In All Browsers

#42

Post by christianmann »

seanalltogether wrote: post #26

Is a GET request in an iframe now considered a CSRF vulnerability? As far as I know, he hasn't actually done any cross site scripting. If i submit this as a link on hacker news and get a bunch of people to click it, have I forged a cross domain request as well? https://mail.google.com/mail/u/0/?logout

Cross site scripting (XSS) is not the same thing as CSRF. If you were to do that, it wouldn't be a CSRF, because the action originated with the user.

Normally CSRFs are automatic, either in the form of an image (https://...?logout />) or an iframe src attribute. So, if you included the above image tag on your page, then it would be a CSRF, sometimes also called a Confused Deputy Attack.

Re: #1 CSRF Is A Vulnerability In All Browsers

#43

Post by mcherm »

homakov wrote: post #28
rdl wrote: post #20

You realize you could be monetizing these security vulnerabilities, right?

how? If I report nobody pays even 'thank you'.

That is true for some people, but NOT for all. Recognized security experts, or anyone with a reputation in the field CAN get themselves heard, and information which they report will NOT be ignored. (Whether you will get paid for it is another matter. It depends.)

You used to be a "nobody" -- just some unknown developer whose English communication skills are a bit weak and who was likely to get ignored. That is no longer true. You are now "famous" in security circles, and if you approach people in a professional manner then I am confident that you will be heard.

Re: #1 CSRF Is A Vulnerability In All Browsers

#45

Post by radicalbyte »

elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

It didn't log me out. Must be down to Chrome Adblock, or Facebook Disconnect.

Re: #1 CSRF Is A Vulnerability In All Browsers

#46

Post by jerrya »

homakov wrote: post #8
elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

hm yep. should I hide that thing? hm.. Sorry guys in advance.

FWIW, Worked in firefox. Didn't work in Chrome or Opera.

Re: #1 CSRF Is A Vulnerability In All Browsers

#48

Post by kaolinite »

citricsquid wrote: post #40

Maybe this is a good time to ask: I found an xss vulnerability in a website that can be used to cause noticeable problems (enough that fixing it should be a priority) so I contacted the developers behind the site and informed them what caused it, how to fix and an example of it in practice and why it's bad: they've done nothing in over a month. What do I do? I guess the answer is "forget it", but I feel like if I don…

Is it a persistent XSS vuln or does it depend on malicious input being passed via the URL or POST?

It's persistent if it can be saved in a comment or on a profile, etc, and is much more dangerous if so. Non-persistent XSS realistically isn't too big a deal, most sites are vulnerable and it's usually only a problem if you're a big website and therefore vulnerable to phishing attacks.

Re: #1 CSRF Is A Vulnerability In All Browsers

#49

Post by homakov »

rdl wrote: post #34
homakov wrote: post #28

Earlier quoted context omitted.

how? If I report nobody pays even 'thank you'.

Fuck reporting it, unless you're contractually obligated because they've retained you (or, if it's an open source project you like, and want to support). If vendors won't even listen to you, clearly they don't value your time or their product, or their customers. You can sell security vulnerabilities to a variety of parties. If you want introductions, email me. Some people view this as "wrong" in some ethical way, bu…

I've been black in the past, now I'm completely white hat.

Re: #1 CSRF Is A Vulnerability In All Browsers

#50

Post by VMG »

radicalbyte wrote: post #45
elisee wrote: post #4

Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom). Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).

It didn't log me out. Must be down to Chrome Adblock, or Facebook Disconnect.

I have adblock plus and FB disconnect, still logged me out
Post reply on HN