Prominent Web sites found to have serious coding flaw

Two Princeton University academics have found a type of coding flaw on several prominent Web sites that could jeopardize personal data.

Two Princeton University academics have found a type of coding flaw on several prominent Web sites that could jeopardize personal data and in one alarming case, drain a bank account.

The type of flaw, called cross-site request forgery (CSRF), allows an attacker to perform actions on a Web site on behalf of a victim who is already logged into the site.

CSRF flaws have largely been ignored by Web developers due to a lack of knowledge, wrote William Zeller and Edward Felten, who authored a research paper on their findings.

The flaw was found on the Web sites of The New York Times; ING Direct, a US savings bank; Google's YouTube; and MetaFilter, a blogging site.

To exploit a CSRF flaw, an attacker has to create a special Web page and lure a victim to the page. The malicious Web site is coded to send a cross-site request through the victim's browser onto another site.

Unfortunately the programming language that underpins the Internet, HTML, makes it easy to do two types of requests, both of which can be used for CSRF attacks, the authors wrote.

That fact points to how Web developers are pushing the programming envelope to design Web services but sometimes with unintended consequences.

"The root cause of CSRF and similar vulnerabilities probably lies in the complexities of today's Web protocols and the gradual evolution of the Web from a data presentation facility to a platform for interactive services," according to the paper.

Some Web sites set a session identifier, a piece of information stored in a cookie, or a data file within the browser, when a person logs onto the site. The session identifier is checked, for example, throughout an online purchase, to verify that the browser engaged in the transaction.

During a CSRF attack, the hacker's request is passed through the victim's browser. The Web site checks the session identifier, but the site cannot check to ensure that the request came from the right person.

The CSRF problem on The New York Times' Web site, according to the research paper, allows an attacker to obtain the e-mail address of the user who is logged into the site. That address could then potentially be spammed.

The newspaper's Web site has a tool that lets logged-in users e-mail a story to someone else. If visited by the victim, the hacker's Web site automatically sends a command through the victim's browser to send an e-mail from the paper's Web site. If the destination e-mail address is the same as the hacker's, the victim's e-mail address will be revealed.

As of Sept. 24, the flaw had not been fixed, although the authors wrote they notified the newspaper in September 2007.

ING's problem had more alarming consequences. Zeller and Felten wrote the CSRF flaw allowed an additional account to be created on behalf of a victim. Also, an attacker could transfer a victim's money into their own account. ING has since fixed the problem, they wrote.

On MetaFile's Web site, a hacker could obtain a person's password. On YouTube, an attack could add videos to a user's "favorites" and send arbitrary messages on a user's behalf, among other actions. On both sites, the CSRF problems have been fixed.

Luckily, CSRF flaws are easy to find and easy to fix, which the authors give technical detail on in their paper. They've also created a Firefox add-on that defends against certain kinds of CSRF attacks.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?