CSRF attack on LiveJournal

Posted by staktrace on Thursday December 01, 2011 @08:40AM
from the lj-support.livejournal.com dept.

( 3 comments | 8 points | on HN )

Re:CSRF attack on LiveJournal by samarudge on Thursday December 01, 2011 @08:58AM (#3299715)

How is this CSRF? This is just phishing, CSRF is something completely different.

[ Parent | on HN ]

Re:CSRF attack on LiveJournal by adammacleod on Thursday December 01, 2011 @10:07AM (#3299951)

"The attack will appear as though someone has left you a comment, but an image similar to the following will appear requesting your password:"

Without knowing anything about the attack my guess is that the author is probably confused with XSS.

[ Parent | on HN ]

Re:CSRF attack on LiveJournal by MattBearman on Thursday December 01, 2011 @09:29AM (#3299826)

My thoughts exactly, there's no cross site requests happening, its all taking place on the phishing server (liviejournal.com)

[ Parent | on HN ]