Computerworld

Prominent sites found to have serious coding flaw

Princeton academics find a flaw that could jeopardise personal data
  • Jeremy Kirk (Unknown Publication)
  • 05 October, 2008 22:00

Two Princeton University academics have found a type of coding flaw on several prominent websites that could jeopardise personal data and in one alarming case, drain a bank account.

The flaw was found on the websites of The New York Times; ING Direct, a US savings bank; Google's YouTube; and MetaFilter, a blogging site.

The flaw, called cross-site request forgery (CSRF), allows an attacker to perform actions on a website on behalf of a victim who is already logged into the site.

CSRF flaws have largely been ignored by web developers due to a lack of knowledge, wrote William Zeller and Edward Felten, who authored a research paper on their findings.

To exploit a CSRF flaw, an attacker has to create a special web page and lure a victim to the page. The malicious website is coded to send a cross-site request through the victim's browser onto another site.

Unfortunately the programming language that underpins the internet, HTML, makes it easy to do two types of requests, both of which can be used for CSRF attacks, the authors wrote.

That fact points to how web developers are pushing the programming envelope to design web services but sometimes with unintended consequences.

"The root cause of CSRF and similar vulnerabilities probably lies in the complexities of today's web protocols and the gradual evolution of the Web from a data presentation facility to a platform for interactive services," according to the paper.

Some websites set a session identifier, a piece of information stored in a cookie, or a data file within the browser, when a person logs onto the site. The session identifier is checked, for example, throughout an online purchase, to verify that the browser engaged in the transaction.

During a CSRF attack, the hacker's request is passed through the victim's browser. The Web site checks the session identifier, but the site cannot check to ensure that the request came from the right person.

The CSRF problem on The New York Times' website, according to the research paper, allows an attacker to obtain the email address of the user who is logged into the site. That address could then potentially be spammed.

The newspaper's website has a tool that lets logged-in users email a story to someone else. If visited by the victim, the hacker's website automatically sends a command through the victim's browser to send an email from the paper's web site. If the destination email address is the same as the hacker's, the victim's email address will be revealed.

As of September 24, the flaw had not been fixed, although the authors wrote they notified the newspaper in September 2007.

ING's problem had more alarming consequences. Zeller and Felten wrote the CSRF flaw allowed an additional account to be created on behalf of a victim. Also, an attacker could transfer a victim's money into their own account. ING has since fixed the problem, they wrote.

On MetaFile's Web site, a hacker could obtain a person's password. On YouTube, an attack could add videos to a user's "favourites" and send arbitrary messages on a user's behalf, among other actions. On both sites, the CSRF problems have been fixed.

Luckily, CSRF flaws are easy to find and easy to fix, which the authors give technical detail on in their paper. They've also created a Firefox add-on that defends against certain kinds of CSRF attacks.