Switched has a new home! Huffpost Tech.

Click here to visit the new home of Switched!

Hot on HuffPost Tech:

See More Stories
AOL Tech

Major Security Holes Found in YouTube, MetaFilter, ING, and NYT

by Terrence O'Brien on October 5, 2008 at 03:05 PM

Major Security Holes Found in YouTube, MetaFilter, ING, and NYT
Researchers at Princeton University found major security holes (warning: PDF) in several popular Web sites. The sites were found to be vulnerable to so called cross-site request forgery (CSRF) attacks, which could allow hackers to manipulate a user's browser or steal information even from a trusted site.

YouTube, MetaFilter, The New York Times, and ING were all found to be vulnerable to these attacks, though all the sites have since plugged the holes. The vulnerability didn't effect all of the sites in the same way, but all would have compromised user data.

The most dangerous vulnerability existed on ING, where a hacker could have used the hole to create an account on behalf of a customer and transfer funds to the new fraudulent account. YouTube accounts were open to attacks that would allow a user's favorites and friends lists to be hijacked. MetaFilter accounts were effected in the same way. The New York Times Web site left users e-mail addresses vulnerable by harvesting by hackers who could then build e-mail lists for spamming.

The holes have all been plugged after being alerted by researchers, but leaves us to wonder what potentially dangerous weaknesses are left undiscovered out there on the Web. The group did create a Firefox extension that protects a user from CSRF attacks even if a Web page isn't properly guarded against them. [From: CNET]

Tags: ing, metafilter, new york times, NewYorkTimes, nyt, security, youtube

HuffPost AOL Social News Most Popular