Singlesnet.com Account Hijacking

210182 Resource 202615 202768 202768 1217523158027 1217529740460 Controlled XSRF Vulnerability Found on Singlesnet.com

Cross-site Request Forgery (XSRF) vulnerability found on Singlesnet.com

<a href="http://badgadgets.typepad.com/my_weblog/2008/06/singlesnet-acco.html"><img alt="XSRF vulnerability found on singlesnet.com" hspace="10" src="http://www.cenzic.com/images/blog/singlesnet.jpg" align="right" vspace="10" border="0" /></a>I reported this <a title="Singlesnet.com Account Hijacking" href="http://badgadgets.typepad.com/my_weblog/2008/06/singlesnet-acco.html" target="_blank">XSRF vulnerability almost a year ago</a> to Singlesnet.com and got no response, so I've decided its time to share it with the community.  The root of the problem is <a title="What is an XSRF vulnerability" href="http://en.wikipedia.org/wiki/XSRF" target="_blank">Cross-Site Request Forgery (XSRF)</a> using an off-domain POST.  Now some of you may not be familiar with XSRF attacks so I will summarize the root cause.  XSRF attacks exploit a Web site's trust of its own user -- its a way of getting a user to make a request to the Web application that they are unaware of and do not authorize.  In other words, the attacker causes your browser to make a request to the Web site that has deleterious effects.  Now some of these attacks can involve malicious links (i.e. you follow the link and subsequently take an unintended action within the Web application).  Another variation of the attacks can involve forms. The attacker creates a malicious form that autosubmits with a piece of JavaScript.  You view the form, and your browser makes a request to the target application on your behalf and the attacker controls the content.Now to Singlesnet.com:Their site architecture allows you to change your password without supplying your current password.  Bad idea.  Basically, your account password, contact email, and username can all be automatically changed in one fell swoop.The proof of concept has been removed.  If you wanna know how it works, you’ll have to figure it yourself ;-) by Tom Stracener <a href="mailto:TStracener@cenzic.com">TStracener@cenzic.com</a> 9 application/xml false Singlesnet.com XSRF XSRF vulnerability Singlesnet.com Account Hijacking Cross-site request forgery found on Singlesnet.com http://badgadgets.typepad.com/my_weblog/2008/06/singlesnet-acco.html Cross-Site Request Forgery (XSRF) Learn more about XSRF from Wikipedia http://en.wikipedia.org/wiki/XSRF Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) 127.0.0.1 127.0.0.1 eswanson 64.60.123.45 false true false false true 204329 false false true false false false true 218976 Resource 204329 173239 202768 1227644850543 1227655160717 Controlled Massachusetts Attorney General investigating 21 complaints of Singlesnet.com

Massachusetts investigating growing mountain of complaints against dating site

Singlesnet.com has been amassing a growing mountain of complaints regarding its trade practices. As of November 25, 2008, the Massachusetts Attorney General's office (617-727-8400) has been investigating 21 complaints, all received within the past two years. The Better Business Bureau has taken down its review of this company, ostensibly for a "re-review". Reviews of this website abound on the Internet-please be careful. 10 application/xml false Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) 127.0.0.1 127.0.0.1 eswanson 64.60.123.45 false true false false true 202615 blog blogsite/Cenzic/web