3 ms·
Gmail account contacts were stolen in a CSRF attack (combined with another vulnerability). This type of attack is often overlooked, but it's very real. http://
by etjossem 11y ago
Gmail account contacts were stolen in a CSRF attack (combined with another vulnerability). This type of attack is often overlooked, but it's very real.
http://archive.oreilly.com/pub/post/gmail_exploit_contact_list_hij.html http://archive.oreilly.com/pub/post/gmail_exploit_contact_li...
- zer01 11y agoAs far as I can tell that particular vulnerability isn't a CSRF at all, it's an insecure JSONP endpoint[1]. The original author is mistaken. [1] http://homakov.blogspot.com/2013/02/are-you-sure-you-use-jsonp-properly.html http://homakov.blogspot.com/2013/02/are-you-sure-you-use-jso...
- ryanlol 11y agoCSRF attacks are very real, but the impact is generally taken into account before calling things a "vulnerability". e.g you can have a SQL injection that's not a vulnerability because the input passes through a substr($_GET["id"],1,1).