Re:#1 CSRF Is A Vulnerability In All Browsers
by tptacek on Saturday March 31, 2012 @05:14PM
(#3781561)
You didn't answer my question.
Re:#1 CSRF Is A Vulnerability In All Browsers
by javajosh on Saturday March 31, 2012 @06:33PM
(#3781764)
You didn't ask a question (was there a question mark in your post that I missed?). You did, however, make an assertion which I corrected.
In an honest, respectful discussion that would occasion a response along the lines of either: "Ah, I didn't think about it like that. Let me see about adjusting the line of my reasoning," or, "No, your correction is invalid because..."
Forgery is like DDoS in that they both use the unwitting (and unwilling) compute resources of an intermediate victim to mount the attack. The unit of distribution of the DDoS case is a binary rootkit (for example) and the unit of distribution for a forgery attack is a web page.
The impact of successful DDoS and CSRF attacks are very different, of course, but the mechanism used to carry them out is very similar. In particular, they both differ from an ordinary hacker-to-target penetration, DoS, forgery etc. attack.