4 ms·

This "Don't Click" virus may have the great benefit of giving CSRF (Cross-Site Request Forgery) the sort of front-page news that will spur developers of social

This "Don't Click" virus may have the great benefit of giving CSRF (Cross-Site Request Forgery) the sort of front-page news that will spur developers of social sites to adopt safe(r) cookie practices. ...and more and more sites are adopting at least some cookie-based social features. Demonstrations that the (apparently) innocent "Don't Click" virus is poorly defended against at Twitter will likely mean that more nefarious and damaging are being cooked right now. Neophyte developers like myself keep having to remind myself that there more stringent rules need to be applied to surfing from same browser as used for database access such as phpMyAdmin: http://news.ycombinator.com/item?id=209457 http://news.ycombinator.com/item?id=209457 For other noobs like me, the wikipedia entry should strike the fear of black-hatting in you: http://en.wikipedia.org/wiki/Cross-site_request_forgery http://en.wikipedia.org/wiki/Cross-site_request_forgery

coderrr 18y ago
This wasn't CSRF, but clickjacking, aka UI redressing. CSRF protection does nothing against it. There are some ways to attempt to defend against it but I don't think there is any 100% reliable way yet. http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing) http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_pag...
- CalmQuiet 18y ago
  Thank you for clarification. It seems that Twitter thinks (http://blog.twitter.com/2009/02/clickjacking-blocked.html http://blog.twitter.com/2009/02/clickjacking-blocked.html) they are reliably defending against it. Someone will soon be trying to determine if theirs is "100% reliable" yet. EDIT: So what do you think of the sufficiency of the "fix" as explained at: http://dsandler.org/outgoing/dontclick.html http://dsandler.org/outgoing/dontclick.html ?
  - coderrr 18y ago
    this might be a way around it in IE http://code.google.com/p/browsersec/wiki/Part3#Microsoft_Internet_Explorer_frame_restrictions http://code.google.com/p/browsersec/wiki/Part3#Microsoft_Int...
    - coderrr 18y ago
      and one way around this is http://keepitlocked.net/archive/2008/11/07/preventing-clickjacking-with-framebusting.aspx http://keepitlocked.net/archive/2008/11/07/preventing-clickj...
      - wesley 18y ago
        They've just fixed this it seems. Content is now hidden in iframes.
  - coderrr 18y ago
    Here's another way around it: http://coderrr.wordpress.com/2009/02/13/preventing-frame-busting-and-click-jacking-ui-redressing/ http://coderrr.wordpress.com/2009/02/13/preventing-frame-bus...
- tectonic 18y ago
  Thanks for the link to Google's browsersec page, that's really useful. http://code.google.com/p/browsersec/wiki/Main http://code.google.com/p/browsersec/wiki/Main

coderrr 18y ago

This wasn't CSRF, but clickjacking, aka UI redressing. CSRF protection does nothing against it. There are some ways to attempt to defend against it but I don't think there is any 100% reliable way yet. http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing) http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_pag...

CalmQuiet 18y ago
Thank you for clarification. It seems that Twitter thinks (http://blog.twitter.com/2009/02/clickjacking-blocked.html http://blog.twitter.com/2009/02/clickjacking-blocked.html) they are reliably defending against it. Someone will soon be trying to determine if theirs is "100% reliable" yet. EDIT: So what do you think of the sufficiency of the "fix" as explained at: http://dsandler.org/outgoing/dontclick.html http://dsandler.org/outgoing/dontclick.html ?
- coderrr 18y ago
  this might be a way around it in IE http://code.google.com/p/browsersec/wiki/Part3#Microsoft_Internet_Explorer_frame_restrictions http://code.google.com/p/browsersec/wiki/Part3#Microsoft_Int...
  - coderrr 18y ago
    and one way around this is http://keepitlocked.net/archive/2008/11/07/preventing-clickjacking-with-framebusting.aspx http://keepitlocked.net/archive/2008/11/07/preventing-clickj...
    - wesley 18y ago
      They've just fixed this it seems. Content is now hidden in iframes.
- coderrr 18y ago
  Here's another way around it: http://coderrr.wordpress.com/2009/02/13/preventing-frame-busting-and-click-jacking-ui-redressing/ http://coderrr.wordpress.com/2009/02/13/preventing-frame-bus...
tectonic 18y ago
Thanks for the link to Google's browsersec page, that's really useful. http://code.google.com/p/browsersec/wiki/Main http://code.google.com/p/browsersec/wiki/Main