7 ms·

Frankly, I don't see any reason why Google isn't right here. This "vulnerability" can only be exploited by appending another one, fishing. It's reasonable to sa

Frankly, I don't see any reason why Google isn't right here. This "vulnerability" can only be exploited by appending another one, fishing. It's reasonable to say, "If AB is a vulnerability only if B is a vulnerability, then A is not a vulnerability". That you can't solve fishing [as a service owner, without also owning the browser] is unfortunate but irrelevant.

eadz 10y ago
I disagree. The linked google page ( https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op... ) makes the argument about the mouse hover tooltip, as if that is the only risk of an open redirect. This is much worse, this is a redirect after login. You just logged into google, you entered your 2FA code, and then the next site you arrive at you damn well expect to be google. Additionally, the OP is correct in that there is a whitelist bypass happening here. Why bother to whitelist *.google.com/ if you can bypass it with a redirect.
- cbsmith 10y ago
  > then the next site you arrive at you damn well expect to be google. Actually, if it is an untrusted URL, I'm not sure why I'd expect that.
  - eadz 10y ago
    I think if google (verified with ssl cert etc) is asking for my password, there was a certain expectation there, but you're right, I should be less trusting ;) Here is the demonstration url from the report https://accounts.google.com/ServiceLogin?service=mail&continue=https://www.google.com/amp/yahoo.com#identifier https://accounts.google.com/ServiceLogin?service=mail&contin... My point isn't about 'open redirects' not being a security issue, it's that the report should be valid because it's a whitelist bypass. continue=yahoo.com is blocked but continue=https://www.google.com/amp/yahoo.com https://www.google.com/amp/yahoo.com is not blocked. both do the same thing as far as the end user is concerned.
    - gyey 10y ago
      continue=https://www.google.com/amp/yahoo.com https://www.google.com/amp/yahoo.com is taking me to a Google error page that says yahoo.com is invalid amp code.
      - lsaferite 10y ago
        Weird, it worked perfectly for me just now.
      - adrianratnapala 10y ago
        I am being redirected to a page that will let me change my google account recovery options. My guess is that posting this thing on HN has caused them to fix it. OR maybe I'm being phished.
      - gyey 10y ago
        the /amp/ hack only works for desktop and not mobile. I was on mobile and that's why I got the Google error page.
- admax88q 10y ago
  > at you damn well expect to be google. That's not really true though. Google serves as an identity provider providing login into 3rd party websites. Plus there's also OAuth prompts when 3rd party services want to use your Google data.
  - deleted 10y ago
    [deleted]
  - rathish_g 10y ago
    > at you damn well expect to be google. If it's again asking for a password, it must be Google.
    - djsumdog 10y ago
      No, that's not true. Think of every time you click on a "sign in with Google" link. If you're not signed in, it will take you to this login page. The redirect will only send back a token, and only for that site.
innoying 10y ago
I totally agree. I don't even see how the impact is even more than the open-redirects which already exist. You could do this exact same exploit against tons of providers (Facebook, Twitter, etc) via the standard OAuth flow and the 'redirect_url' parameter.
- peteretep 10y ago
  Because I go to a page, check the green padlock and all that noise, it's all legit, enter my credentials, oops I typed them in wrong, try again, right now I'm logged in properly... I would say I am dramatically less likely to exercise as much caution on the "Ooops wrong credentials" page having checked the original one.
  - praxulus 10y ago
    Perhaps it's just safer to use a password manager for everything.
    - Godel_unicode 10y ago
      Somewhere, Tavis Ormandy is cringing.
      - niij 10y ago
        Does he have a statement regarding password managers?
        Godel_unicode 10y ago
        He's been finding bugs galore in them recently. https://mobile.twitter.com/taviso/status/769391927892598784 https://mobile.twitter.com/taviso/status/769391927892598784 Edit: this one is better https://mobile.twitter.com/taviso/status/769378052254015488 https://mobile.twitter.com/taviso/status/769378052254015488
  - developer2 10y ago
niftich 10y ago
Agreed. Open redirect aside, this is simply social engineering; someone convinces the victim to navigate to a crafted URL hoping for some eventual exfiltration of credentials. This kind of issue is a good demonstration that it's not (just) the payload of the URL that's important -- in this case the deception may be more difficult to spot -- but also who's asking to go there and why.
ebbv 10y ago
That's a weak excuse for this horrible security hole. Google is facilitating phishing with this terrible behavior. It means that someone trying to phish a Google user can send someone to a totally valid google.com URL and it will still result in their credentials being stolen. That's the #1 thing that you teach non-technical people to avoid phishing; "Make sure the site you're on is the one you think you're logging into." Because Google has chosen to be sloppy and dumb that simple instruction is not enough to protect people. Google is 100% wrong here. This is a blatant hole and just a lazy, sloppy stupid, way too broad whitelist.
kuschku 10y ago
Try this variant: (link removed, see video below) And tell me your parents/grandparents/etc will not mistake that for the real thing. (you can enter whatever you want into the phishing form, it will just take you back to this post – but someone with less morals could do entirely different things) EDIT: Video for mobile users (this page doesn’t work on mobile): https://cdn.kuschku.de/ServiceLogin/video.mp4 https://cdn.kuschku.de/ServiceLogin/video.mp4
- woliveirajr 10y ago
  Perfect example. Everything that I can see in my cell looks right, including informations from the green padlock, just opening (and understanding! ) the whole URL would make one NOT enter the password.
  - kuschku 10y ago
    And that’s the thing, thanks to Let’s Encrypt, the padlock on the fake site also stays, everything looks normal. If you now also register something like accountsgoogle.com or a similar page, people likely wouldn’t even notice. This is like it’s made for phishing.
- gyey 10y ago
  This is what I get: "Sorry, this page is not valid AMP HTML"
  - kuschku 10y ago
    Do you happen to be on mobile? This particular site only works on desktop, at the moment. I’ll do a screenrecording for you mobile users in a moment. https://cdn.kuschku.de/ServiceLogin/video.mp4 https://cdn.kuschku.de/ServiceLogin/video.mp4
    - gyey 10y ago
      Yes, I'm on mobile. That must be it.
- deleted 10y ago
polemic 10y ago
> "If AB is a vulnerability only if B is a vulnerability, then A is not a vulnerability" Stringing together multiple (seemingly) insignificant vulnerabilities to pivot through a system or own a user is hacking 101. I'm not sure how you'd fix this, but given Google's prevalence as an authentication provider, it's definitely not worth being glib about.
decisiveness 10y ago
Agreed, and not trying to be pedantic, but it might be more accurate to say: "If AB is a vulnerability only if B is present, then A is not a vulnerability".

eadz 10y ago

I disagree. The linked google page ( https://sites.google.com/site/bughunteruniversity/nonvuln/open-redirect https://sites.google.com/site/bughunteruniversity/nonvuln/op... ) makes the argument about the mouse hover tooltip, as if that is the only risk of an open redirect. This is much worse, this is a redirect after login. You just logged into google, you entered your 2FA code, and then the next site you arrive at you damn well expect to be google. Additionally, the OP is correct in that there is a whitelist bypass happening here. Why bother to whitelist *.google.com/ if you can bypass it with a redirect.

cbsmith 10y ago
> then the next site you arrive at you damn well expect to be google. Actually, if it is an untrusted URL, I'm not sure why I'd expect that.
- eadz 10y ago
  I think if google (verified with ssl cert etc) is asking for my password, there was a certain expectation there, but you're right, I should be less trusting ;) Here is the demonstration url from the report https://accounts.google.com/ServiceLogin?service=mail&continue=https://www.google.com/amp/yahoo.com#identifier https://accounts.google.com/ServiceLogin?service=mail&contin... My point isn't about 'open redirects' not being a security issue, it's that the report should be valid because it's a whitelist bypass. continue=yahoo.com is blocked but continue=https://www.google.com/amp/yahoo.com https://www.google.com/amp/yahoo.com is not blocked. both do the same thing as far as the end user is concerned.
  - gyey 10y ago
    continue=https://www.google.com/amp/yahoo.com https://www.google.com/amp/yahoo.com is taking me to a Google error page that says yahoo.com is invalid amp code.
    - lsaferite 10y ago
      Weird, it worked perfectly for me just now.
    - adrianratnapala 10y ago
      I am being redirected to a page that will let me change my google account recovery options. My guess is that posting this thing on HN has caused them to fix it. OR maybe I'm being phished.
    - gyey 10y ago
      the /amp/ hack only works for desktop and not mobile. I was on mobile and that's why I got the Google error page.
admax88q 10y ago
> at you damn well expect to be google. That's not really true though. Google serves as an identity provider providing login into 3rd party websites. Plus there's also OAuth prompts when 3rd party services want to use your Google data.
- deleted 10y ago
  [deleted]
- rathish_g 10y ago
  > at you damn well expect to be google. If it's again asking for a password, it must be Google.
  - djsumdog 10y ago
    No, that's not true. Think of every time you click on a "sign in with Google" link. If you're not signed in, it will take you to this login page. The redirect will only send back a token, and only for that site.

innoying 10y ago

I totally agree. I don't even see how the impact is even more than the open-redirects which already exist. You could do this exact same exploit against tons of providers (Facebook, Twitter, etc) via the standard OAuth flow and the 'redirect_url' parameter.

peteretep 10y ago
Because I go to a page, check the green padlock and all that noise, it's all legit, enter my credentials, oops I typed them in wrong, try again, right now I'm logged in properly... I would say I am dramatically less likely to exercise as much caution on the "Ooops wrong credentials" page having checked the original one.
- praxulus 10y ago
  Perhaps it's just safer to use a password manager for everything.
  - Godel_unicode 10y ago
    Somewhere, Tavis Ormandy is cringing.
    - niij 10y ago
      Does he have a statement regarding password managers?
      - Godel_unicode 10y ago
        He's been finding bugs galore in them recently. https://mobile.twitter.com/taviso/status/769391927892598784 https://mobile.twitter.com/taviso/status/769391927892598784 Edit: this one is better https://mobile.twitter.com/taviso/status/769378052254015488 https://mobile.twitter.com/taviso/status/769378052254015488
- developer2 10y ago

niftich 10y ago

Agreed. Open redirect aside, this is simply social engineering; someone convinces the victim to navigate to a crafted URL hoping for some eventual exfiltration of credentials. This kind of issue is a good demonstration that it's not (just) the payload of the URL that's important -- in this case the deception may be more difficult to spot -- but also who's asking to go there and why.

ebbv 10y ago

That's a weak excuse for this horrible security hole. Google is facilitating phishing with this terrible behavior. It means that someone trying to phish a Google user can send someone to a totally valid google.com URL and it will still result in their credentials being stolen. That's the #1 thing that you teach non-technical people to avoid phishing; "Make sure the site you're on is the one you think you're logging into." Because Google has chosen to be sloppy and dumb that simple instruction is not enough to protect people. Google is 100% wrong here. This is a blatant hole and just a lazy, sloppy stupid, way too broad whitelist.

kuschku 10y ago

Try this variant: (link removed, see video below) And tell me your parents/grandparents/etc will not mistake that for the real thing. (you can enter whatever you want into the phishing form, it will just take you back to this post – but someone with less morals could do entirely different things) EDIT: Video for mobile users (this page doesn’t work on mobile): https://cdn.kuschku.de/ServiceLogin/video.mp4 https://cdn.kuschku.de/ServiceLogin/video.mp4

woliveirajr 10y ago
Perfect example. Everything that I can see in my cell looks right, including informations from the green padlock, just opening (and understanding! ) the whole URL would make one NOT enter the password.
- kuschku 10y ago
  And that’s the thing, thanks to Let’s Encrypt, the padlock on the fake site also stays, everything looks normal. If you now also register something like accountsgoogle.com or a similar page, people likely wouldn’t even notice. This is like it’s made for phishing.
gyey 10y ago
This is what I get: "Sorry, this page is not valid AMP HTML"
- kuschku 10y ago
  Do you happen to be on mobile? This particular site only works on desktop, at the moment. I’ll do a screenrecording for you mobile users in a moment. https://cdn.kuschku.de/ServiceLogin/video.mp4 https://cdn.kuschku.de/ServiceLogin/video.mp4
  - gyey 10y ago
    Yes, I'm on mobile. That must be it.
deleted 10y ago

polemic 10y ago

> "If AB is a vulnerability only if B is a vulnerability, then A is not a vulnerability" Stringing together multiple (seemingly) insignificant vulnerabilities to pivot through a system or own a user is hacking 101. I'm not sure how you'd fix this, but given Google's prevalence as an authentication provider, it's definitely not worth being glib about.

decisiveness 10y ago

Agreed, and not trying to be pedantic, but it might be more accurate to say: "If AB is a vulnerability only if B is present, then A is not a vulnerability".