81–90 of 96 posts
Doesn't the target need to have an active router admin session for the CSRF to work? Unless I'm missing something...
tl;dr: Social engineering won. It was over the moment he got tricked into clicking on a link in an email.
So we live in a world where you can browse to a page and have your network compromised? Consider reading the story.
While this is an interesting article and this is certainly feasible, I'm left with the opinion that this is fiction and didn't actually happen.
Would anyone give a more in-depth comment regarding why this didn't happen?
"It took about a week before Bill decided to upgrade notepad++ to the new version." Which is why I'm always wary of installing unsigned software. In such cases I try to check some hashes some way. Obviously if the download page lists them I check against those, but in most cases it's insufficient because that page is not HTTPS. So I always help myself with google, both by googling the filename to find some pages list…
I didn't understand which hashes you are talking about. Do installs usually provide a checksum or? I have not found any that do, or maybe I just ignore it.
Suppose I download Putty and am unsure of whether it's the real thing or whether it's a Trojan, e.g. due to someone having hacked my router. I compute the hash of the file and google it: http://lmgtfy.com/?q=44ac2504a02af84ee142adaa3ea70b868185906... . I find many sites saying that's putty.exe. If I didn't, I'd be very suspicious.
Doesn't the target need to have an active router admin session for the CSRF to work? Unless I'm missing something...
I'm curious how the email attack worked, don't most web-based email services flag emails that come from one domain, but contain a link to another?
I guess it's a good thing I have my laptop setup to use google's dns no matter what network i'm on.
"It took about a week before Bill decided to upgrade notepad++ to the new version." Which is why I'm always wary of installing unsigned software. In such cases I try to check some hashes some way. Obviously if the download page lists them I check against those, but in most cases it's insufficient because that page is not HTTPS. So I always help myself with google, both by googling the filename to find some pages list…
Sounds extremely involved.
>google "44ac2504a02af84ee142adaa3ea70b868185906f"
>see results are mostly "putty.exe"
Three steps, all relatively painless.
Earlier quoted context omitted.
Not really. Depending on the protocol CSRFs are often an easy 1-click exploit on noscript-enabled browsers. Something like this: " /> Is the corresponding 1-click that works on noscript.
Hmm, I thought ClearClick would catch that, but apparently it doesn't. That's unnerving. Even ABE lets it through. That said, it would still require the victim to load the fake LinkedIn page (with the wrong domain), which is more likely to look suspicious. And it would've loaded the router page after the POST (instead of redirecting to LinkedIn), which would definitively signal that something was wrong.