Bugtraq mailing list archives

Re: eyeOS checksum prediction


From: jose () eyeos org
Date: 19 Sep 2007 03:59:40 -0000


I think that you don't understand the idea behind the checkNUM (is not a checkSUM ;) in the eyeOS ajax calls.

the checknum, is a number to protect eyeOS againt automatic requests, for example, if I'm using my eyeOS, my session is 
alive, and I enter another website, with iframes or something similar, for make a get to my eyeOS to delete a file, a 
file will be deleted, and this isn't good :)

the checknum DO NOT protect against yourself, the owner of a session, can know the checknum assigned to each app (each 
app have a different checknum)

Please, before send FALSE reports, you have to understand what you are auditing, thanks.


Current thread: