In the dark spirit of the day's news, we learn that if your bank doesn't fail, criminals could siphon off your money. And no, not those Washington or Wall Street hacks.

Princeton University researchers say they've found four Web sites vulnerable to the cross-site request forgery (CSRF) attack, reports Dark Reading. An attack on INGDirect.com's site would allow an attacker to transfer money out of a victim's bank account.

ING, YouTube and MetaFilter have since fixed the flaws, but one on The New York Times Web site remains. It could allow an attacker to harvest e-mail addresses of online subscribers.

Princeton doctoral student Bill Zeller explained the CSRF bug on the ING site would have allowed an attacker to move money from the victim's account to a fake account the attacker set up in the user's name -- all without the user's knowledge. He called it the first publicly disclosed CSRF flaw on a bank site.