Comment by aakilfernandes | Hacker News Reader

Comment by aakilfernandes | Hacker News Reader

Parent Full thread

At first I thought this was some crazy low level hack since I saw all the hex code. But thats just a library used by the hacker (its not really part of the hack).

Scroll all the way to the bottom and you'll see the meat of it. Its a bunch of window.opens to certain urls that cause money to be transferred out of the wallets.

I'm not sure why they use window.open instead of AJAX requests. Is there something on Tor Browser that would prevent that?

    window.open (url+"/startresetpin?action=askresetpinaction&controller=user&confirmed=true&confirm-submit=", "_blank");
    window.open (url+"/resetpin?pin1=1111&pin2=1111&submit=Save", "_blank"); 
    window.open (redirectUrl+"?action=send&amount=1&wait=1", "_blank"); 
    window.open (redirectUrl+"?action=send&amount=0.01&wait=2", "_blank");

Edit: looks like that library isn't even used by the hack. Maybe its just there to dissuade onlookers from reading the code.

Same Origin Policy would prevent AJAX requests, CSRF attacks thus usually use hidden forms -- window.open achieves the same, but with the opportunity to send multiple requests.

This isn't the case anymore. Since CORS was introduced, you can send xhr GET Requests to arbitrary domains.

The browser then checks if the appropriate CORS headers are set. If they are, you can access the response. If they aren't, you can't.

As a sane developer you are supposed not to trigger ANY actions on a GET anyway and there are a lot more ways to trigger them, so this is not an issue in the browser.

For POST and friends it's a bit more complicated, the browser sends an OPTIONS request first and checks if the CORS headers are set and only if they are, the actual POST is submitted.

Fun Fact: It looks like it's possible to exploit this issue silently even with javascript disabled and NoScript installed, it's quite lame to do it the way they did.

You could still use hidden forms to send multiple requests, just set the form target to "_blank". You can't, however, send POST requests any other way.

Ah good point. Couldnt they of just included fake images or iframes instead?

Reply on news.ycombinator.com