hiring
i wonder if chuck can code...an ideal site admin methinks
Interweb Chuck Norris infiltrates Netflix, Tivo
Researcher Lance James has been busy devising ways to play tricks on some of the world's bigger websites using an exotic attack known as CSRF, or cross site request forgery. While his exploits amount to little more than pranks, they point to the very sobering realization that the net isn't a very secure place. One proof-of- …
This topic is closed for new posts.
Scarily cool
Very slick. NoScript and Adblock were of no help there.
Seems like...
...someone should use this to add a Rick Astley documentary to peoples' Netflix queues... Assuming there is one. There's gotta be, right?
Surprise!
Just when I forgot that the web is pants, someone reminded me! Just in the nick of time, too. I was about to trust a load of websites with my naked pictures.
Scary, but it's no Chuck Norris
When someone exploits a vulnerability that steals your passwords, edits your details and finishes off by roundhouse kicking your monitor through a window, then, and only then, will they be entitled to use the Chuck Norris analogy.
Doesnt work for me
I have netflix in my "trusted zone" and of course the demo page is not in my trusted zone, so it doesnt work. So thats what "zones" are for ;)
Oops
Seems I was wrong, the "trusted zones" approach DID NOT protect against this. Oh well.
Just think...
...how you could mess with the stats!
And this weeks No 1 film (by popular demand) is: ishtar!
Very nice
Now that's some serious inventiveness. Well done on him, and now we'll soon see what's needed to plug the holes properly.
Interesting.
I got a notification that i was not in the US.
Does anyone know if it works across browser instances ?
@ Mark McC
"When someone exploits a vulnerability that steals your passwords, edits your detail"
You missed out "just with his teeth".
GET and POST
Those demonstrations have to submit the cross-site requests as HTTP GET, because they're images and redirects (which happen automatically). But the requests being made are state-changing, so they should be POSTs (requiring user interaction). How would a check in the website's server-side form processing for GET vs POST (or for the HTTP referrer, for that matter) inconvenience the user?
lol?
"While his exploits amount to little more than pranks, they point to the very sobering realization that the net isn't a very secure place."
Hi Dan,
Welcome to 1995, the year when everyone else already figured this out.
By sobering realization I can only assume you mean you've been too drunk to notice the net is inherently insecure for the last 14 years.
This topic is closed for new posts.
Sign up, sign up for The Register's weekly IT security newsletter - click here
Popular Whitepapers
- The BI Inflexion Point
Information is a right, not a privilege - Risk and Resilience
The application availability gamble - Register Research on: Agile development - is it right for you
Reaping the benefits of modern software practice - The Register Guide to managing spam
A primer on the implications for enterprise IT - The Register Guide to email security
A primer on the challenges of securing email and approaches to resolving them - High Performance for All
Responding to the needs of compute-intensive workloads
