February 10, 2008   Sign In |  About ebizQ |  Contact Us |  Join ebizQ Gold Club
Peter Schooff
Peter Twenty-Four Seven Security
Peter Schooff's blog is a daily look at what's going on in the world of computer security with an emphasis on how it affects businesses.

« Identity Management Must Look Pretty Cheap Now | Main | The Challenges of SOA Security: A Discussion with Layer 7 »

January 29, 2008
Hacker Who-Done-It

Dark Reading details a very scary exploit called cross-site request forgery (CSRF), where hackers can force someone else's browser to, as Dark Reading says, "to conduct searches on behalf of the attacker, grab files or pages, post messages to online forums, and even make changes to the user's Website accounts."

What's the advantage of that, you wonder? Well, because once the exploit is revealed and the perpetrator is caught red-handed, that red-handed perpetrator most likely didn't do it (as hacker who-done-its often rely on a browser's cookies and cache).

And the worst thing about it is cross-site request forgery is it's a vulnerability found in many web applications and much harder to eradicate than cross-site scripting vulnerabilities. To get the lowdown on application security, I highly recommend listening in on Mike Rothman's recent ebizQ podcast with Michael Gavin right here.

Posted by pschooff in |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/3090

Comments Post a comment




Remember Me?

(you may use HTML tags for style)

We ask that you type your code (displayed below) in the text box.This code is an image that cannot be read by a machine. It prevents automated programs from submitting comments.


Code:



Most Recent ebizQ Blog Entries
ADVERTISEMENT
Subscribe
News Feed
Blog Roll
Blogosphere
This Work
Accountability:The opinions expressed in this blog are solely representative of the blog's author, and not of ebizQ

Subscribe to our Newsletters
ebizQ Weekly Gold Club Update
Live Webinar Updates
Updates from ebizQ Partners
ebizQ SOA Update
ebizQ BPM Update
ebizQ Security Update
ebizQ BI Update
ebizQ Open Source Software Update
Virtual Show Newsletter
Your E-mail Address:
BAM: The Killer App for CEP
Date: Feb 12, 2008
Time: 12:00 PM ET
(17:00 GMT)

I WANT TO ATTEND
Event Processing Market Pulse
Date: Feb 14, 2008
Time: 12:00 PM ET
(17:00 GMT)

I WANT TO ATTEND
Archived Webinars | Upcoming Webinars

Marketing Solutions | Feedback | About ebizQ | Unsubscribe | Privacy Policy | Site Map