Popular Websites Vulnerable to Cross-Site Request Forgery Attacks

221486 Resource 202615 202768 202768 1229980620566 1229997033645 Controlled YouTube: Real World Hacking Example

CSRF vulnerabilities discovered in almost every action a user could perform on YouTube

<a href="http://www.freedom-to-tinker.com/blog/wzeller/popular-websites-vulnerable-cross-site-request-forgery-attacks"><img alt="YouTube - Real World Hacking Example" hspace="10" src="http://www.cenzic.com/images/blog/youtube.jpg" align="right" vspace="10" border="0" /></a>YouTube is the second big-brand company that we are featuring from Bill Zeller’s recent <a title="CSRF paper on these popular vulnerabilities" href="http://www.freedom-to-tinker.com/sites/default/files/csrf.pdf" target="_blank">paper</a> and <a title="CSRF vulnerabilities found on 4 big Websites" href="http://www.freedom-to-tinker.com/blog/wzeller/popular-websites-vulnerable-cross-site-request-forgery-attacks" target="_blank">post</a> that got hacked through a CSRF vulnerability.    Zeller discovered CSRF vulnerabilities in nearly every action a user could perform on YouTube.  Specific details are described in the paper.  Here are a few examples of what an attacker could do on YouTube via the CSRF vulnerabilities:  § Add videos to a user's "Favorites," § Add himself to a user's "Friend" or "Family" list,§ Send arbitrary messages on the user's behalf,§ Flag videos as inappropriate,§ Automatically share a video with a user's contacts, § Subscribe a user to a "channel" (a set of videos published by one person or group) and, § Add videos to a user's "QuickList" (a list of videos a user intends to watch at a later point).  According to the report, YouTube has fixed these vulnerabilities. by Erin Swanson <a href="mailto:Eswanson@cenzic.com">Eswanson@cenzic.com</a> 9 application/xml false hack YouTube Popular Websites Vulnerable to Cross-Site Request Forgery Attacks 4 real-world example of how hackers attack Websites http://www.freedom-to-tinker.com/blog/wzeller/popular-websites-vulnerable-cross-site-request-forgery-attacks Cross-Site Request Forgeries: Exploitation and Prevention Read this 13 page paper on CSRF http://www.freedom-to-tinker.com/sites/default/files/csrf.pdf Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727) 127.0.0.1 127.0.0.1 eswanson 64.60.123.45 false true false false true 204329 false false true false false false true 202615 blog blogsite/Cenzic/web