<<< Date Index >>>     <<< Thread Index >>>

Re: Linksys WRT54 GL - Session riding (CSRF)




The catch is that this exploit don't work unnoticed, because the admin
get notification in the browser that there has occured an error with the
cerificate ["Unable to verify the identity of Linksys as a trusted
site"] and he has explicity allow it. In other words first he has to
allow to be attacked...
It's generally (although not always!) a requirement of CSRF that the user has already logged in. So there won't be any new notification window popping up.

It will make it harder for the attacker to stealthily attack multiple targets without someone noticing, though.

Like Basic Authentication (which is ugly for the end-user, but browsers can defend slightly better against attacks over it), this is one of the cases where a little bit of user friction helps reduce attacks.

It's an open question as to whether end users pay attention to security pop-ups at all. :)