5

Sorry very new to security.

If a user is logged into a secure site (credentials are SSN and a password) and then is victim to a CSRF, can their log in information be at risk?

3 Answers 3

5

A CSRF attack is a blind attack where the attacker can control the request sent to the server, but due to the same origin policy cannot get the contents of the HTTP response. To get the response one would need something like Cross-Site-Scripting or DNS-Rebinding attacks. That's at least the case with the default behavior, but if the target server employs a (non-default) wide open CORS policy reading the response from an CSRF attack using XMLHttpRequest might be possible too.

But one can still cause lots of damage, like changing the DNS settings in a router and from then on effectively be the man in the middle. See How millions of DSL modems were hacked in Brazil....

3

Potentially, yes. But only if you have far worse security concerns. If you expose any endpoints that initiate data-transfer to a new location (such as changing the email address on an account) a CSRF attack allows the attacker to send a request to this, which could enable access to their data.

However generally no, CSRF attacks are blind, and often use things like iFrames which cannot be read by the attacker.

There are a number of precautions you can take, which include verification tokens being used in any request that could potentially cause information exposure.

13
  • Could you, perhaps, provide an example of a CSRF attack? :> Commented Jan 29, 2016 at 14:57
  • I don't have the time to write a proof of concept, and a vulnerable service. But it would really just be a bit of javascript that sends the request, and then another bit that sends the response to the attacker. You don't seem like the sort of person that would need a PoC though ;)
    – Will
    Commented Jan 29, 2016 at 15:00
  • 1
    A CSRF attack is a blind attack, i.e. the attacker can only send a HTTP request but not see the content of the HTTP response from the server. Commented Jan 29, 2016 at 15:00
  • Is the case? I'll happily amend my answer if I'm wrong, but I'm almost certain a PoC was shown to me before where they send a request via JS which allowed them to receive the response.
    – Will
    Commented Jan 29, 2016 at 15:01
  • @WilliamDunne Perhaps a link to a reference, then? Others may appreciate it. I know I would. Commented Jan 29, 2016 at 15:01
2

Yes and no. Yes because it can modifies information without the user consent but no because it cannot gather information. CSRF is a blind attack.

CSRF stands for Cross Site Request Forgery. The idea is that when you visit a malicious site, this site will initiate a request to a target site. For example :

I visit malicious.com and when I hit their page they do a post to stackoverflow.com/change_password?new_password=abc. If stackoverflow doesn't protect itself from CSRF attack, the attacker would have been able to change my password on stackoverflow.

The reason CSRF attacks work is that they are initiated by the legitimate user. From the point of view of stackoverflow, it was me that decided to change my password, not the attacker, and that's why it succeeded. If the attacker was trying himself from his computer to change my password, it would fail because he wouldn't be logged in to stackoverflow (like my computer is).

But can an attacker gather information from CSRF attacks?

No. CSRF is a blind attack. The attacker doesn't receive feedback from his posts. When he tried to change my password on stackoverflow, he didn't receive any reply confirming that his attack was successful.

Even if he was using iframe to launch the request he wouldn't be able to gather information on the result of his attack because of the same origin policy.

2
  • Thank you! So if a user is filling out a form but never submits or clicks a link that information in the form can't be stolen? and even if they do the information isn't seen just could be used to perform other activities?
    – MStidh1
    Commented Jan 29, 2016 at 15:20
  • 1
    @MStidh1 The user doesn't do anything else than visit a malicious link during a CSRF attack. As soon as you load the page, the attack can happen, you don't have anything else to do. Then, the CSRF attack can only execute an action on the target site but never receive feedback.
    – Gudradain
    Commented Jan 29, 2016 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .