News for hackers. Stuff that matters.

A comment on Hacker News CSRF Vulnerability. Parent comment

Re:Hacker News CSRF Vulnerability by etjossem on Thursday February 25, 2016 @04:04PM (#11177777)
Gmail account contacts were stolen in a CSRF attack (combined with another vulnerability). This type of attack is often overlooked, but it's very real.

http://archive.oreilly.com/pub/post/gmail_exploit_contact_li...

[ Parent | on HN ]
Re:Hacker News CSRF Vulnerability by zer01 on Thursday February 25, 2016 @04:11PM (#11177825)
As far as I can tell that particular vulnerability isn't a CSRF at all, it's an insecure JSONP endpoint[1]. The original author is mistaken.

[1] http://homakov.blogspot.com/2013/02/are-you-sure-you-use-jso...

[ Parent | on HN ]
Re:Hacker News CSRF Vulnerability by ryanlol on Thursday February 25, 2016 @04:14PM (#11177845)
CSRF attacks are very real, but the impact is generally taken into account before calling things a "vulnerability".

e.g you can have a SQL injection that's not a vulnerability because the input passes through a substr($_GET["id"],1,1).

[ Parent | on HN ]