bugtraq - Re: Linksys WRT54 GL - Session riding (CSRF)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <478CF689.9030000@calyptix.com>
Date: Tue, 15 Jan 2008 13:08:09 -0500
From: Daniel Weber <dweber@...yptix.com>
To: bugtraq@...urityfocus.com
Subject: Re: Linksys WRT54 GL - Session riding (CSRF)

> The catch is that this exploit don't work unnoticed, because the admin
> get notification in the browser that there has occured an error with the
> cerificate ["Unable to verify the identity of Linksys as a trusted
> site"] and he has explicity allow it. In other words first he has to
> allow to be attacked...
It's generally (although not always!) a requirement of CSRF that the 
user has already logged in.  So there won't be any new notification 
window popping up.

It will make it harder for the attacker to stealthily attack multiple 
targets without someone noticing, though.

Like Basic Authentication (which is ugly for the end-user, but browsers 
can defend slightly better against attacks over it), this is one of the 
cases where a little bit of user friction helps reduce attacks.

It's an open question as to whether end users pay attention to security 
pop-ups at all. :)