Forgot your password?
typodupeerror
Security

Nasty Security Flaw In OAuth, OpenID 18

Posted by Soulskill
from the another-day-another-flaw dept.
jones_supa writes: "A notable security vulnerability has been discovered which impacts both OAuth and OpenID, which are software packages that provide a secure delegated access to websites. Wang Jing, a Ph.D student at the Nanyang Technological University in Singapore, discovered that the 'Covert Redirect' flaw can masquerade as a login popup based on an affected site's domain. Covert Redirect is based on a well-known exploit parameter. For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication. If a user chooses to authorize the login, personal data will be released to the attacker instead of to the legitimate website. Wang did already warn a handful of tech giants about the vulnerability, but they mostly dodged the issue. In all honesty, it is not trivial to fix, and any effective remedies would negatively impact the user experience. Users who wish to avoid any potential loss of data should be careful about clicking links that immediately ask you to log in to Facebook or Google, and be aware of this redirection attack."
This discussion has been archived. No new comments can be posted.

Nasty Security Flaw In OAuth, OpenID

Comments Filter:
  • by kiite (1700846) on Friday May 02, 2014 @05:21PM (#46903191)

    Ehh...

    First of all, this isn't new. Hell, it's in the RFC [ietf.org]. In fact, the RFC specifically details and recommends protecting against it in [ietf.org] several [ietf.org] places [ietf.org].

    This is an implementation problem, not really anything to do with OAuth 2.0 or OpenID-Connect. Authorization servers are supposed to match the redirect_uri against valid values that are registered by the client. This is inconvenient for redirecting users back to the right page, so some popular providers decided to match based on prefix or domain, instead. And some websites on the internet have open redirects (hard to believe, i know). If the client website's security is _really_ lousy^H^H^H^H^H lax, its OAuth2 callback module might also not validate the response URI when it gets the access code, and may even not strip the access code from the URI parameters when redirecting.

    The service providers are supposed [ietf.org] to require clients to register a full redirection callback. The clients can keep track of whatever page people are on with the state parameter. But those same clients, with that same terrible security, will probably get that wrong, too.

    So, it's entirely a known problem, and what it boils down to is this: You can recommend best practices, but you can't fix stupid. That's why Google and Facebook are shrugging it off.

    That said, if they performed some meager sanitization, it could go a long way to improve the situation.

    • by yakatz (1176317)
      Agreed. Not sure why this is news, or honestly, why it is worthy of being published at all. This is part of the design and if people choose to login even after - the as the example says - Google or Facebook OAuth prompt says You are sending the following information to this site: (as those login methods do [postimg.org]), that is their own problem.
      • Agreed. Not sure why this is news, or honestly, why it is worthy of being published at all.

        If you hadn't noticed after the heartbleed bug, the media reporting on flaws these days has no clue what is going on.

        But they are looking for a story. Because it catches eyeballs. The iPhone SSL bug proved that bugs can provide hysteria, so expect to see more hysteria.

    • by fisted (2295862)
      good related read [hueniverse.com]
  • by GoodNewsJimDotCom (2244874) on Friday May 02, 2014 @05:24PM (#46903225)
    The instant I saw a Facebook login on a non Facebook website, I assumed it was a phisher.

    This phishing attack has been around as long as this flawed protocol has been around.

    Move along, nothing to see here, everyone knew this.
    • by GoodNewsJimDotCom (2244874) on Friday May 02, 2014 @05:32PM (#46903285)
      Heh, I see what they're saying now. This new phishing attack fools the person who "verifies" it is a Facebook.com URL. I guess it is somewhat worse. Your average Facebook user doesn't even know to check that so regular phishing attempts should work too. I guess someone of Slashdot style tech knowledge might have always checked to make sure the URL was Facebook. So I guess the warning is good for some of us. Personally I don't log in to Facebook from rogue sites.

      Oh snap, I just realized where this would get people real hard. Paypal. You click a link to buy with Paypal, but they send you to a PaypalURL to login, but keep your data... Yah, that one could bite. I guess it really is a good heads up. I'll no longer use anyone's paypal links unless I highly trust the site. Thankfully I at least have the 2nd factor security authentication, but not everyone has that.
      • by phantomfive (622387) on Friday May 02, 2014 @05:59PM (#46903491) Journal

        Oh snap, I just realized where this would get people real hard. Paypal. You click a link to buy with Paypal, but they send you to a PaypalURL to login, but keep your data... Yah, that one could bite. I guess it really is a good heads up. I'll no longer use anyone's paypal links unless I highly trust the site. Thankfully I at least have the 2nd factor security authentication, but not everyone has that.

        I solve that problem by not linking my Paypal to a bank account. If someone hacks my paypal account, they can......use their own credit card to pay someone.

        Not linking Paypal to a bank account solves a lot of other problems too, where Paypal is known to be the rogue actor.

        • by xelah (176252)

          Mmm...I can't help thinking there's a hole in that somewhere. Couldn't they use the account to accept a bunch of payments for sales they don't intend to fulfil, transfer the money to themselves and then leave you with the chargebacks? Quite possibly PayPal will come after you if your account is negative.

          • If that happens I will have the great pleasure of telling Paypal to please, take all the money in my account, and close it.
  • by DadLeopard (1290796) on Friday May 02, 2014 @11:42PM (#46905709)
    I've been seeing this a LOT on Facebook. I myself am not stupid enough to log in to a site I am already logged into, but this has bitten a whole lot of my less savvy "friends"! Seems to be a regular Phishing feature where there is slightly risque picture and when you click to see full size they want you to prove you are over 13 by logging in ! Hah! Not happening!

Whoever dies with the most toys wins.

Working...