A pair of researchers here yesterday unleashed a tool that automatically executes dangerous cross-site request forgery (CSRF) attacks.
Shawn Moyer and Nathan Hamiel demonstrated how their tool, MonkeyFist, performs what they call "dynamic" CSRF attacks, or attacks on Websites that have put up preventative measures such as tokenization and session IDs . CSRF is when an attacker makes a Web request within the context of the victim's Web session.
The researchers say the emergence of integrated and aggregated content, such as buttons for Twitter or "Digg This," have opened up even more possibilities for these attacks, which take advantage of a pervasive but difficult-to-detect vulnerability in many Websites.
This "session-riding" attack basically lets the bad guy silently ride atop the victim's Web session. "You're [the attacker] already authenticated into a site, and the user's session, header, and cookie is already there," says Moyer, a hacker on the Security Assessments Team at FishNet Security. "You're already there, so what you're doing is getting the user to do something and you're riding on their session."
It lets an attacker steal credentials from a user, by luring the victim to his malicious Website, for example. The researchers demonstrated a CSRF attack using MonkeyFist on the global password function on Newsweek.com during their presentation here at Black Hat.
MonkeyFist is a Python-based Web server tool that listens and automates per-request, dynamic CSRF attacks. In the demo here, MonkeyFist pointed a Newsweek.com "user" to a "bad guy's" site via the publication's password reset process. The user then went to Reddit, the social networking news and digest site. "A hidden POST reset his password and took him to YouTube," where the researchers had set up a phony video, says Hamiel, senior security consultant with Idea Information Security.
"Using MonkeyFist makes it easy to do host-based CSRF," he says. "It lets you get session ID information through cross-referrer leakage."
The researchers say the tool also simplifies the previously onerous task of a POST-based CSRF attack.
Shawn Moyer and Nathan Hamiel demonstrated how their tool, MonkeyFist, performs what they call "dynamic" CSRF attacks, or attacks on Websites that have put up preventative measures such as tokenization and session IDs . CSRF is when an attacker makes a Web request within the context of the victim's Web session.
The researchers say the emergence of integrated and aggregated content, such as buttons for Twitter or "Digg This," have opened up even more possibilities for these attacks, which take advantage of a pervasive but difficult-to-detect vulnerability in many Websites.
This "session-riding" attack basically lets the bad guy silently ride atop the victim's Web session. "You're [the attacker] already authenticated into a site, and the user's session, header, and cookie is already there," says Moyer, a hacker on the Security Assessments Team at FishNet Security. "You're already there, so what you're doing is getting the user to do something and you're riding on their session."
It lets an attacker steal credentials from a user, by luring the victim to his malicious Website, for example. The researchers demonstrated a CSRF attack using MonkeyFist on the global password function on Newsweek.com during their presentation here at Black Hat.
MonkeyFist is a Python-based Web server tool that listens and automates per-request, dynamic CSRF attacks. In the demo here, MonkeyFist pointed a Newsweek.com "user" to a "bad guy's" site via the publication's password reset process. The user then went to Reddit, the social networking news and digest site. "A hidden POST reset his password and took him to YouTube," where the researchers had set up a phony video, says Hamiel, senior security consultant with Idea Information Security.
"Using MonkeyFist makes it easy to do host-based CSRF," he says. "It lets you get session ID information through cross-referrer leakage."
The researchers say the tool also simplifies the previously onerous task of a POST-based CSRF attack.
Comments