Cross-site request forgery (CSRF), which is a security hole affecting all browsers, needs immediate attention because it poses a great risk, said Hacker Egor Homakov.
CSRF security holes have been around for a long time, but quite a few people have underestimated the dangers that hide behind them, Homakov said. Unlike cross-site scripting (XSS) attacks which exploit the trust of a user towards a particular site, CSRF attacks rely on the trust that a site has in a browser.
RELATED STORIES
Browsers hit with Framesniffing
Chrome Attack Trap Falls Flat
Browsers Fall in Hacking Contest
Chrome Falls, IE Follows
Homakov said when users sign in to any site, dubbed by the researcher as site1.com, the cookie mechanism remembers them. By leveraging the vulnerability, the hacker can shorten the website’s session and social engineer the victim into signing in again.
The user signs in the second time and a malicious script triggers. Then, when the user visits a second site, named site2.com, he or she becomes a victim.
“You visit site site2.com. No matter how you got there — let’s assume friend gave you the link. That site sells ‘iframe traffic’ (or just contains malicious code itself). It means that funny site uses your browser (and your accounts on all sites where you are logged in!!),” Homakov said.
“You know nothing and notice nothing. Hidden iframe loads malicious Javascript which executes POST(or GET/DELETE/PATCH etc – all HTTP Verbs are supported) by submitting generated