Researcher Lance James has been busy devising ways to play tricks on some of the world's bigger websites using an exotic attack known as CSRF, or cross site request forgery. While his exploits amount to little more than pranks, they point to the very sobering realization that the net isn't a very secure place. One proof-of- …
Very slick. NoScript and Adblock were of no help there.
...someone should use this to add a Rick Astley documentary to peoples' Netflix queues... Assuming there is one. There's gotta be, right?
i wonder if chuck can code...an ideal site admin methinks
Just when I forgot that the web is pants, someone reminded me! Just in the nick of time, too. I was about to trust a load of websites with my naked pictures.
Scary, but it's no Chuck Norris
When someone exploits a vulnerability that steals your passwords, edits your details and finishes off by roundhouse kicking your monitor through a window, then, and only then, will they be entitled to use the Chuck Norris analogy.
Doesnt work for me
I have netflix in my "trusted zone" and of course the demo page is not in my trusted zone, so it doesnt work. So thats what "zones" are for ;)
Seems I was wrong, the "trusted zones" approach DID NOT protect against this. Oh well.
...how you could mess with the stats!
And this weeks No 1 film (by popular demand) is: ishtar!
Now that's some serious inventiveness. Well done on him, and now we'll soon see what's needed to plug the holes properly.
I got a notification that i was not in the US.
Does anyone know if it works across browser instances ?
@ Mark McC
"When someone exploits a vulnerability that steals your passwords, edits your detail"
You missed out "just with his teeth".
GET and POST
Those demonstrations have to submit the cross-site requests as HTTP GET, because they're images and redirects (which happen automatically). But the requests being made are state-changing, so they should be POSTs (requiring user interaction). How would a check in the website's server-side form processing for GET vs POST (or for the HTTP referrer, for that matter) inconvenience the user?
I blame apple
For inventing iFrames
"While his exploits amount to little more than pranks, they point to the very sobering realization that the net isn't a very secure place."
Welcome to 1995, the year when everyone else already figured this out.
By sobering realization I can only assume you mean you've been too drunk to notice the net is inherently insecure for the last 14 years.