Paid Advertising
web application security lab

Join a Religion Via CSRF

Okay, I waited long enough to tell this story, but it’s funny enough that it’s worth it. At SOURCE Boston, Jeremiah, Mark Kranack and I were sitting around talking and apparently at one point long ago he had started a religion. The religion was simple, all you had to do was accept Mark as your god and that’s that. No fees, no prayers, no nothing, just accept him as your god. You don’t even have to do it on purpose, one guy joined by accident as a matter of fact by inadvertantly saying that Mark was his god as he described it. There’s no way to get kicked out of his religion and nothing really special about it in any way beyond the religious leader, of course. You can still find a reference to it on the internet archive.

Then we got to talking and laughing and ultimately came up with a CSRF joke of all time. We could get tens of thousands, maybe hundreds of thousands, or even millions of people to join through CSRF via images to forms on MySpace, or what have you. You see, there is a bit of a bug in the acceptance program of Kraynackism. You don’t have to necessarily “say” that Mark is your God it turns out, you just have to somehow indicate it to him, either intentionally or inadvertantly as we saw with his friend. We could turn Kraynackism into the fastest growing religion the world has ever seen! You could be a member right now and you wouldn’t even know it!

It’s funny but it’s less funny when you talk about getting people arrested in China as we talked about a long time ago or of course going to jail for child porn, etc… Funny and scary all at the same time.

10 Responses to “Join a Religion Via CSRF”

  1. rbl Says:

    ‘cigars’ again, huh? ;)

  2. Lawrence Pingree Says:

    No false gods here please :)

  3. Profit Says:

    My religion: Apatheism. Join, don’t join, whatever.

  4. Jac Says:

    Aha! Maybe the bug in the acceptance program is being made intentionally :P

  5. dex Says:

    oh my god! :-)

  6. Awesome AnDrEw Says:

    Sounds like some other cults and scams most everyone is aware of.

  7. elpeor Says:

    god is an ugly and very bad used idea , no more.

  8. donwalrus Says:

    the fact that *this* post had so many responses should entitle YOU to Deity status…by indication or other means I suppose :-D

  9. Torstein Says:

    So how do I exploit government funding of religious organization which is based on the number of members?

  10. Drazen Drazic Says:

    If I can own the franchise in Australia, I will get tax benefits and some government funding for this religion. All we have to do is to show it is a religion ie; we have a few followers! ie; a belief in something un-defineable!

    From there, we need some policies that our followers will need to adopt. (Talking IT speak - in the old days, “commandments”). Once we have those, we can start to preach and “ask” for money….you need that…Lear Jets and Towers of Belief etc.

    Can we ensure that drinking, smoking and hot women are not a sin in this new religion?! If you plan to go all new testament on me, count me out!