Cross-Site Request Forgery (CSRF)

View the slides.

This week we talked about cross-site request forgery (CSRF) and tried it out with an interactive demo using a mock bank website.

Weekly content

• Vuln Report on BMW Cars
  • https://thehackernews.com/2018/05/bmw-smart-car-hacking.html
  • https://thehackernews.com/2016/09/hack-tesla-autopilot.html
  • https://keenlab.tencent.com/en/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf
• Spectre Variant 4
  • https://thehackernews.com/2018/05/fourth-critical-spectre-cpu-flaw.html
  • https://www.redhat.com/en/blog/speculative-store-bypass-explained-what-it-how-it-works
  • https://newsroom.intel.com/editorials/addressing-new-research-for-side-channel-analysis/
  • https://developer.arm.com/support/arm-security-updates
• How Secure Is Your City?
  • https://www.darkreading.com/vulnerabilities---threats/las-vegas-most-insecure-cyber-city-in-us-st-louis-least-vulnerable/d/d-id/1331868
  • https://www.benzinga.com/pressreleases/18/05/p11754481/coronet-report-names-americas-most-cyber-insecure-cities-las-vegas-mem
  • https://coro.net/wp-content/uploads/2018/05/Coronet_Americas_Most_Insecure_Cities.pdf
• ZipperDown
  • https://www.darkreading.com/endpoint/zipperdown-vulnerability-could-hit-10--of-ios-apps/d/d-id/1331867
  • https://zipperdown.org/
  • https://nakedsecurity.sophos.com/2018/05/18/zipperdown-catches-16000-ios-apps-with-their-pants-down/
• #Dont$hareTheWhere
• T-Mobile SIM Swap

CSRF

Info links:

• https://en.wikipedia.org/wiki/Cross-site_request_forgery
• https://www.scmagazine.com/popular-websites-fall-victim-to-csrf-exploits/article/554987/
• https://blog.qualys.com/webappsec/2017/01/26/cross-site-request-forgery-what-happened-to-the-sleeping-giant

CSRF demo site