back to article Interweb Chuck Norris infiltrates Netflix, Tivo

Researcher Lance James has been busy devising ways to play tricks on some of the world's bigger websites using an exotic attack known as CSRF, or cross site request forgery. While his exploits amount to little more than pranks, they point to the very sobering realization that the net isn't a very secure place. One proof-of- …

COMMENTS

This topic is closed for new posts.
  1. Del Merritt
    Pirate

    Scarily cool

    Very slick. NoScript and Adblock were of no help there.

  2. Anonymous Coward
    Thumb Up

    Seems like...

    ...someone should use this to add a Rick Astley documentary to peoples' Netflix queues... Assuming there is one. There's gotta be, right?

  3. lupine

    hiring

    i wonder if chuck can code...an ideal site admin methinks

  4. Anonymous Coward
    Anonymous Coward

    Surprise!

    Just when I forgot that the web is pants, someone reminded me! Just in the nick of time, too. I was about to trust a load of websites with my naked pictures.

  5. Mark McC
    Stop

    Scary, but it's no Chuck Norris

    When someone exploits a vulnerability that steals your passwords, edits your details and finishes off by roundhouse kicking your monitor through a window, then, and only then, will they be entitled to use the Chuck Norris analogy.

  6. Anonymous Coward
    Anonymous Coward

    Doesnt work for me

    I have netflix in my "trusted zone" and of course the demo page is not in my trusted zone, so it doesnt work. So thats what "zones" are for ;)

  7. Anonymous Coward
    Anonymous Coward

    Oops

    Seems I was wrong, the "trusted zones" approach DID NOT protect against this. Oh well.

  8. Anonymous Coward
    Thumb Up

    Just think...

    ...how you could mess with the stats!

    And this weeks No 1 film (by popular demand) is: ishtar!

  9. Wortel
    Thumb Up

    Very nice

    Now that's some serious inventiveness. Well done on him, and now we'll soon see what's needed to plug the holes properly.

  10. Anonymous Coward
    Anonymous Coward

    Interesting.

    I got a notification that i was not in the US.

    Does anyone know if it works across browser instances ?

  11. Elmer Phud
    Happy

    @ Mark McC

    "When someone exploits a vulnerability that steals your passwords, edits your detail"

    You missed out "just with his teeth".

  12. Glyn Kennington

    GET and POST

    Those demonstrations have to submit the cross-site requests as HTTP GET, because they're images and redirects (which happen automatically). But the requests being made are state-changing, so they should be POSTs (requiring user interaction). How would a check in the website's server-side form processing for GET vs POST (or for the HTTP referrer, for that matter) inconvenience the user?

  13. Colin Millar
    Alert

    I blame apple

    For inventing iFrames

  14. Ian

    lol?

    "While his exploits amount to little more than pranks, they point to the very sobering realization that the net isn't a very secure place."

    Hi Dan,

    Welcome to 1995, the year when everyone else already figured this out.

    By sobering realization I can only assume you mean you've been too drunk to notice the net is inherently insecure for the last 14 years.

This topic is closed for new posts.

Biting the hand that feeds IT © 1998–2021