Understanding CSRF Attacks: How They Work and How to Prevent Them

Have you ever wondered how attackers can trick you into performing actions on websites without your knowledge? One common technique they use is called Cross-Site Request Forgery, or CSRF (pronounced "Sea Surf"). It's a sneaky way for attackers to exploit the trust a website has in you once you're logged in. Let’s break it down in simple terms.

What is a Cookie?

Before diving into CSRF let's talk about cookies. No, not the delicious kind hehe. In the digital world a cookie is a small piece of data stored on your computer by your web browser while you're browsing a website. Cookies are like name tags for your browser helping websites remember who you are, what your preferences are, and keeping you logged in.

When a website tells you, "This website uses cookies," it means the site will store some information on your computer to enhance your browsing experience. This can include login status, personalization settings, or tracking your activity for analytics.

What is CSRF?

Now imagine you’re logged into your online banking account, let's call it BankSafe. You have a special cookie in your browser that keeps you logged in allowing you to perform actions without needing to re-enter your password on every page. This cookie is like a VIP pass that tells BankSafe, "Hey, it’s really me, let me do stuff."

An attacker wants to trick you into transferring money to their account. How can they do that? Here’s a step-by-step explanation of how a CSRF attack works:

Step 1: Setting the Trap

The attacker creates a malicious website or sends you an email with a hidden command. This command might look like an image tag but it's actually a request to transfer money:

<img src="https://banksafe.com/transfer?amount=1000&to=attacker_account" />        

Step 2: Visiting the Trap

You unsuspecting and just browsing the internet, visit the attacker’s website or open the email. You see nothing unusual because the hidden command is, well, hidden.

Step 3: Sending the Request

Because you’re logged into BankSafe, your browser automatically includes your VIP cookie with any request to BankSafe. When the hidden image tag tries to load, your browser sends a request to:

https://banksafe.com/transfer?amount=1000&to=attacker_account        

with your special cookie included.

Step 4: The Bank Thinks It's You

BankSafe receives the request along with your cookie. It checks the cookie and thinks "This request is from you, the logged-in user." So it processes the request and transfers $1000 to the attacker’s account. You didn’t even know it happened!!!

Why It Works

• Automatic Cookies: Your browser sends your VIP cookie with every request to BankSafe, so the website can't tell the difference between requests you actually made and those made by the attacker’s hidden commands.
• No Confirmation: BankSafe might not ask for any extra confirmation (like a second password or code) before making the transfer.

How to Prevent CSRF Attacks

Thankfully, there are ways to protect against CSRF attacks:

1- CSRF Tokens: Websites can include a unique token in forms. This token is checked when the form is submitted to make sure the request is genuine.

<form action="https://banksafe.com/transfer" method="POST">
  <input type="hidden" name="csrf_token" value="randomly_generated_token">
  <input type="text" name="amount">
  <input type="text" name="to">
  <input type="submit" value="Transfer">
</form>        

2- SameSite Cookies: Setting cookies with the SameSite attribute ensures they are only sent with requests from the same website, preventing them from being included in cross-site requests.

Set-Cookie: sessionId=abc123; SameSite=Strict;        

3- Double-Check Actions: Asking for a second form of confirmation (like a PIN or 2-factor authentication) before performing sensitive actions.

Conclusion

CSRF attacks take advantage of the trust a website has in your browser’s cookies. By understanding how they work and implementing protective measures like CSRF tokens and SameSite cookies, we can keep our online activities safe and secure.

Next time a website tells you it uses cookies, you’ll know it’s helping to remember you and keep your session secure. Stay safe online and make sure the websites you use are protecting you from these sneaky attacks :)