The Effect of CSRF on a Forensic Investigation

Whilst I mostly agree with the issues raised in this article over at Dark Reading [Exploit Could Taint Forensics], there is one comment that really ground my gears, and I would recommend that the author/editor get their technical facts straight before publishing.

These investigations often rely on a user’s Web browser cache and history to reconstruct a user’s suspicious activity, so if the user’s machine is infected with CSRF, that data isn’t reliable and an innocent user could be mistakenly accused of wrongdoing when it was actually an attacker behind it.

My concern is focused on how a user’s machine can get infected with CSRF as if CSRF is a form of malicious software, when CSRF is not an “infectious” type of software.

I’m not going to go into what CSRF is as a quick check of Wiki is sufficient.

Regardless of this slip up, the issue of these sorts of exploits tainting a forensic investigation is a valid point. Of course, a thorough review of a user’s web history could potentially unveil the site which instantiated the CSRF attack, and highlight that the user’s web history may not be a good source of evidence in a case. This of course does not mean that this evidence is not good evidence, it just has to be reviewed appropriately.

Posted by Christian 29 January 2008

Post A Comment