In information security, people used to think that web-based vulnerabilities were "lame" or "easy." To some extent, they may have been correct: if you look at

In information security, people used to think that web-based vulnerabilities were "lame" or "easy." To some extent, they may have been correct: if you look at the relative complexity of HTTP header fuzzing or a SQL injection attack compared to finding 0day in, say, the Linux kernel, it's generally not even a contest. That said, exploits like this demonstrate the carelessness that can go into many applications and frameworks on the web. In my years of application security, I've seen some "interesting" vulnerabilities like this, but I've seen thousands of people with standard, well-known security problems all over their applications. "Broken Authentication & Session Management" is an extremely common finding for my team to write up. People think that, oh, we don't need this cookie to be marked Secure or HTTPOnly. "If the browser's owned, we're screwed anyway." The problem with this uninformed stance on application security is that exploits do not always need to stand on their own to introduce a significant level of risk. For example, should a cookie not be marked HTTPOnly, the browser itself does not need to be compromised. Simple cross-site scripting (another extremely common issue in webapps) can easily access these cookies and throw them at malicious receivers. This is just one example, but like the article referenced in the original post, it seems to me that some people just don't take security seriously. That said, the research referenced here is pretty cool -- for those of you that missed it, you can read the Black Hat 2011 paper on this issue here: http://media.blackhat.com/bh-us-11/Slaviero/BH_US_11_Slaviero_Sour_Pickles_WP.pdf http://media.blackhat.com/bh-us-11/Slaviero/BH_US_11_Slavier...