Internet Security Tips

A cross-site request forgery attack (CSRF) is one of the most popular tools for cyber-criminals. Besides spear phishing, this method allows them to empty users’ bank accounts.

In this article, we explain how these attacks work and what protective steps you should take.

How to recognize a cross-site request forgery attack?

The CSRF attacks are used for internet fraud, as hackers attempt to take over users’ authenticated sessions and perform malicious actions.

When a user logs into a website, the account remains logged in during the session. It might happen that they also visit another website, during the same session, and click something. There are chances that this page was created by hackers.

If so, hackers send an HTTP request to the site their victims are signed in. Then, they do what they know best: execute malicious actions. All they need for this is the right HTTP request.

This kind of attack is almost always successful because common users would not even notice that there is something strange happening during their session. Also, the server cannot identify that the request comes from an outside source, as the user is logged in.

Three different main CSRF attack types

A cross-site request forgery attack can occur mainly in three different ways. The preferred one for hackers is to plant an exploit URL. They hide this on external websites or even in email messages. So, when users open the URL, an HTTP request is sent.

Sometimes, they use social engineering and URL spoofing. Thus, they disguise the origin of the URL.

Another way would be when instead of building their own malicious website, hackers manipulate an existing one. They do this through cross-site scripting. For this, they use JavaScript planted on websites. Then, cybercriminals are able to perform criminal actions.

Placing malware on their victims’ computers is another way to perform such attacks. Once they do this, attackers can determine the browser to send the HTTP request that they need. Remember that these are only the main ways of action for hackers.

Using this kind of attack, hackers can make requests that seem legitimate, to transfer money from your account to theirs. Also, they can make purchases, post comments, or like on behalf of their victims.

How to prevent these attacks?

Although these attacks might seem difficult to identify, there are still ways to keep yourself safe. You just need to consider these steps:

1. Avoid visiting questionable websites, and opening suspicious emails.
2. Always end active sessions on critical websites, before visiting other ones.
3. Make sure that your device is free of malware. Use a trustworthy malware removal tool, for this. This can keep away many types of attacks.
4. Always use two-factor authentication, when visiting data-sensitive websites.
5. Remember that some browser extensions can delete the referrer header. So, the HTTP could not identify where the requests come from.

Now, that you know how these attacks occur, you can better protect yourself, and avoid becoming a victim.