 YouTube is the second big-brand company that we are featuring from Bill Zeller’s recent paper and post that got hacked through a CSRF vulnerability.
Zeller discovered CSRF vulnerabilities in nearly every action a user could perform on YouTube. Specific details are described in the paper. Here are a few examples of what an attacker could do on YouTube via the CSRF vulnerabilities: § Add videos to a user's "Favorites," § Add himself to a user's "Friend" or "Family" list, § Send arbitrary messages on the user's behalf, § Flag videos as inappropriate, § Automatically share a video with a user's contacts, § Subscribe a user to a "channel" (a set of videos published by one person or group) and, § Add videos to a user's "QuickList" (a list of videos a user intends to watch at a later point). According to the report, YouTube has fixed these vulnerabilities. by
Erin Swanson
Eswanson@cenzic.com | 
