CSRF, The Waking Giant

Jeremiah Grossman recently posted an article on his blog about CSRF and how many security professionals have little knowledge of the attack and its consequences. Another issue Grossman points out is that developers know even less - which is the more troubling of the two.

Anyway, he continues and points out that CSRF may be useful in creating a DDoS attack. By placing img tags, or tags that can make off-site references, that reference the victim site on any large forum or popular website, visitors to the site would then transparently make a set number of requests to the victim site. Through the use of the trigger site's popularity, the number of requests is multiplied significantly therefore triggering a potential DDoS.

This is really scary stuff. Even as a security professional I did not make the leap that Grossman and his other cohorts made, although as most things when it is presented it seems only logical. The simplicity of the attack is also its greatest strength. It is similar in nature to the ' OR 1=1 -- attack used to bypass authentication mechanisms vulnerable to SQLi. Both attacks require a minimum amount of payload to be effective which cuts down on the complexity as well as the preparation significantly.

This simple attack - <* img src="http://victim.com" /> - could turn out to be the next big thing that attackers use. This also makes you wonder, or at least it makes me wonder, what other monsters are out there waiting to to pounce that no one is really aware of yet.