CSRF, Anti-DNS Pinning and NTLM
Mark Goodwin has written a neat discussion of the extra problems that CSRF causes when used alongside DNS pinning attacks and against intranets that use NTLM authentication (AKA Integrated Windows Auth)
The short version is that you might be able to use CSRF and anti-DNS pinning attacks to steal resources from an intranet, including those that need auth NTML authentication.
Getahead predates DWR by quite a while, and Mark has worked with me on a few projects. For the past few years he's been a serious security head, and he's just started blogging.
I'm not going to link to all his posts, so if you are interested in security; subscribe, and I'll get on with the Ajax and Java stuff.
Re: CSRF, Anti-DNS Pinning and NTLM
Like your work and i must subscribe to it as i want always some new stuff about ajax and Java, hope i can see something new, previously i was working on low cost web site hosting services along with some informative web hosting reviews writing but i like the stuff on your pages too and will bring some more friends here to get best information.
Re: CSRF, Anti-DNS Pinning and NTLM
I was thinking about the problem of Cross Site Request Forgery and current mitigation strategies used in the Industry. In many of the real world applications I have tested so far, I see the use of random tokens appended as part of url.
world of warcraft cataclysm