4 ms·
Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom)
by elisee 15y ago
Just in case it might be a problem for anyone: The article uses the CSRF vulnerability to log you out of all Google services (and says so in a PS at the bottom).
Don't open the article if you don't want to have to log in to Google again afterwards (might be a problem if you're using two-factor auth and you don't have your phone handy for instance).
- homakov 15y agohm yep. should I hide that thing? hm.. Sorry guys in advance.
- spicyj 15y agoIt'd be nicer if you had a link to a separate page that does it so that people can read the post first.
- olex 15y agoYou could make it into a button: "Log me out of Google" or something like that. That way, you can still demonstrate it's easily done, but only people who are interested will see it.
- sedictor 15y agoWell, you are jerk
- jerrya 15y agoFWIW, Worked in firefox. Didn't work in Chrome or Opera.
- redthrowaway 15y agoWorked in Chrome for me on Vista (work comp).
- colkassad 15y agoworked in Chrome for me
- LewisCr 15y agoWorks on Android Dolphin
- ovi256 15y agoMaybe make it a button, but just disconnecting is not harmful. Great work by the way, and oh so badly needed. FWIW, worked on Chrome / Mac OS X Snow Leopard.
- dwc 15y agoLeave it. I think it has exactly the effect you wanted.
- jaylevitt 15y agoI don't think a "button" quite conveys the malicious feeling you want to inspire... but maybe a "Read more" link?
- jdkent 15y agoI can't open google reader anymore, as it pulls in the article and logs me out. Kind of annoying, but funny at the same time. Nicely done.
- hanbam 15y agoLooks that Google detects the type of logout and doesn't ask for two-factor authentication in this case.
- spindritf 15y agoIt does, maybe you checked the "Remember this computer for 30 days" box last time you were logging in?
- spindritf 15y agoThere's an info now at the top of the post > To stir up your interest - check any google service e.g. gmail, you are logged out. Great hook btw. Even more impressively, I have all js on his blog blocked through NoScript and it still worked.
- homakov 15y agoI don't run any JS. It's just an image:D
- jiggy2011 15y agoIf the target site treats GET and POST identically then that could still be a problem. Just have <img src="http://targetsite.php/form?submit=1&data=gjoprgrger http://targetsite.php/form?submit=1&data=gjoprgrger />
- Roboprog 15y agoHave some more nightmare fuel: http://ha.ckers.org/xss.html http://ha.ckers.org/xss.html You can inject the things above into somebody else's data, or hide them in your own page from the beginning, I suppose. As a site developer, you can mitigate some mischief a bit by having any destructive update be a two step process: first get a form (or an "are you sure" page, if no real input is required), and add a nonce to the form, which is submitted back with the "request for destruction and subversion". Of course, the attacker can still request the form, harvest the nonce, and send it back with the attacking request, but now his attack has to be 2 steps instead of just 1. Also, if the nonce has a variable name, he has to know to grab everything off of the setup form, and not just resubmit a hard-coded name. Obviously, this won't stop everybody, but it does force them to try a little harder.
- kaonashi 15y agoThe internet must be a very dark place for you.
- tomjen3 15y agoWell no, it is illegally accessing a computer system, which i do believe is a felony.
- radicalbyte 15y agoIt didn't log me out. Must be down to Chrome Adblock, or Facebook Disconnect.
- VMG 15y agoI have adblock plus and FB disconnect, still logged me out
- buster 15y agodidnt log me out either. Adblock plus, FB Disconnect, Ghostery :P
- driverdan 15y agoBlocking 3rd party cookies prevents it.
- radicalbyte 15y agoAhh, that must be it :)
- deleted 15y ago[deleted]
- marquis 15y agoI'm still logged into Gmail on Chrome, so this is an specific browser issue?