4 ms·

First of all, open redirection is not a serious vulnerability. Serious vulnerabilities include remote code execution, SQL injection and cross-slide scripting (d

by dsacco 10y ago

First of all, open redirection is not a serious vulnerability. Serious vulnerabilities include remote code execution, SQL injection and cross-slide scripting (depending on the context). Serious vulnerabilities can be used to compromise user accounts without their interaction. Vulnerability severity is always a bit of a touchy subject, but calling open redirection serious is either hyperbolic or report-padding for security consultants. Second, this vulnerability cannot be used to compromise user accounts or data, let alone with or without their interaction. It is a social engineering attack that could work, yes, but the Google Vulnerability Rewards Program is specifically designed to reward researchers for reporting technical security vulnerabilities, not those leveraged through social engineering. Third, this is a rabbit hole. Google's core functionality is redirecting users to third party websites. You can just as easily send someone a link to a Google redirector that occurs in the browser when you click on a search result. It's not feasible to prevent this, and it's not feasible to prevent social engineering in general. Bug bounty programs require a hard line somewhere in order to function. In order for an attack to be acceptable, it must have a clearly demonstrable foundation in a software implementation failure. It must be clearly defined as a logic error, not an error in human reasoning. The only cases where open redirection and social engineering are eligible are those where they are simply peripheral - an actual technical vulnerability that allows these attacks to scale far beyond manual means (an example might be a technical failure in Facebook's linkshim service). I am disappointed in seeing that this story has risen to the top of the HN front page, because I believe there isn't a single security engineer here that would agree this is a technical vulnerability that should be eligible for a reward.

mangeletti 10y ago
> Serious vulnerabilities include remote code execution... I just meant "serious" in the general sense of the word, like the way that a bullet would in the stomach is serious, even though one in the head is more serious. > Google's core functionality is redirecting users to third party websites I'm pretty sure that Google's core functionality is ads, which don't require the user to actually be actually visiting pages Google. Pertaining using Google for social auth, the user is actually expecting to go back to the site they just came from, whereas when they login to update their credit card they're logging in to stay on Google, which means that a page that looks exactly like Google... How long this functionality remains on the site will be a better indicator. My guess is not long, esp after the publicity.
- dsacco 10y ago
  >> I just meant "serious" in the general sense of the word, like the way that a bullet would in the leg is serious, even though one in the head is more serious." To continue your analogy more accurately, open redirection is not a gunshot wound, it's a cold.
  - parent5446 10y ago
    I don't know about a cold. Maybe the flu, since elderly and children are more at risk. ;)
    - xori 10y ago
      Really, people. Are we seriously doing this...
- tpaksoy 10y ago
  >I'm pretty sure that Google's core functionality is ads You have got to be kidding me... So we're completely going to ignore that everyone is still using Google as a search engine, and not ads? You're making things up just to get your point across.
  - mangeletti 10y ago
    More people see Google ads than any other form of interaction with Google, by a long shot. If you want to talk about Google search, it's obvious, as a user, that when you click a link in the results you're going to be going to the URL that the link points to (even if Google changes the URL when you click it for tracking purposes, there shouldn't be much room for confusion).
ebbv 10y ago
> First of all, open redirection is not a serious vulnerability. I 100% disagree. There was a time when people didn't think XSS was a serious vulnerability too. Most web developers in general are way too casual about a lot of attack vectors, and this is just one more example of that.
- dsacco 10y ago
  Okay, you can disagree, but the word "serious" only works comparatively. If every vulnerability is "serious", then none of them are, and the word loses its meaning and people stop responding to it. If not every vulnerability is "serious" but open redirection is, what do you call something like command injection or SQL injection? "Double-plus serious"? I understand that developers need to take security seriously, but that effort is undermined by being hyperbolic about vulnerability severity. No one is trying to say open redirection isn't a vulnerability, it's just not all that...well, serious. Fix it, but it's not a hair on fire problem.
  - ebbv 10y ago
    I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. Your statement implies there's an unlimited number of these but there aren't. SQL injection is worse than open direction, but storing your passwords and CC data in plaintext and leaving your root account SSH-able on port 22 with no password is worse than SQL injection. Just because there's something worse than X doesn't mean X is not bad. The important thing here is open redirection is a stupid, optional behavior and there's no good reason for it. It shouldn't be there. Allowing it is just as stupid as allowing XSS. It's just lazy and sloppy and frankly inexcusable for a company like Google, which should be held to a much higher standard than a mom and pop web store that sells cat figurines.
    - dsacco 10y ago
      >> I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. So your stance is the first option, that basically any security vulnerability is serious. The grand majority of vulnerabilities are much simpler to fix than they are to find; once you find them, fixing them is generally straightforward. Given that we are using fundamentally different and incompatible definitions of the word "serious", we are obviously going to continue to disagree on this point. Perhaps it would help if I reframe this for you - there are vulnerabilities which warrant an on-call engineer being woken up at 4 am, and there are those which do not. Further, there are vulnerabilities which need to be fixed this week and those which can wait until the next feature release. If you don't like my use of the word "serious", hopefully you'll find that more agreeable. I don't think we are arguing over the same point anymore. You continue on to attack Google for having this vulnerability, but I don't think you have spent much time doing vulnerability research if you react that way about a company of Google's size. The sheer codebase alone basically guarantees every type of vulnerability will be found. Furthermore, being antagonistic about it in the way that you are is not conducive to recognition or remediation. Attempting to shame companies or engineering teams is counterproductive to developer awareness and education. At the end of the day, this is just a specialization and your job is not to be mean to them for making mistakes, it's to try to improve their understanding and help them resolve the issue while avoiding it in the future.
deleted 10y ago
[deleted]
secamo 10y ago
dsacco is correct in my mind. I work as a security researcher and penetration tester, and I would only include this in a client report as an informational or low risk vulnerability at best in a vulnerability assessment. In a penetration testing narrative I likely wouldn't even bring it up. Even if we look at the social engineering side of things, this is likely not something I'd bother with. There are so many social engineering attack vectors I would give priority to over this as an attacker. A hardline really does need to be drawn with regards to bug bounty programs, or we would constantly be chasing the proverbial rabbit.
- deleted 10y ago
  [deleted]

by dsacco 10y ago

mangeletti 10y ago

> Serious vulnerabilities include remote code execution... I just meant "serious" in the general sense of the word, like the way that a bullet would in the stomach is serious, even though one in the head is more serious. > Google's core functionality is redirecting users to third party websites I'm pretty sure that Google's core functionality is ads, which don't require the user to actually be actually visiting pages Google. Pertaining using Google for social auth, the user is actually expecting to go back to the site they just came from, whereas when they login to update their credit card they're logging in to stay on Google, which means that a page that looks exactly like Google... How long this functionality remains on the site will be a better indicator. My guess is not long, esp after the publicity.

dsacco 10y ago
>> I just meant "serious" in the general sense of the word, like the way that a bullet would in the leg is serious, even though one in the head is more serious." To continue your analogy more accurately, open redirection is not a gunshot wound, it's a cold.
- parent5446 10y ago
  I don't know about a cold. Maybe the flu, since elderly and children are more at risk. ;)
  - xori 10y ago
    Really, people. Are we seriously doing this...
tpaksoy 10y ago
>I'm pretty sure that Google's core functionality is ads You have got to be kidding me... So we're completely going to ignore that everyone is still using Google as a search engine, and not ads? You're making things up just to get your point across.
- mangeletti 10y ago
  More people see Google ads than any other form of interaction with Google, by a long shot. If you want to talk about Google search, it's obvious, as a user, that when you click a link in the results you're going to be going to the URL that the link points to (even if Google changes the URL when you click it for tracking purposes, there shouldn't be much room for confusion).

ebbv 10y ago

> First of all, open redirection is not a serious vulnerability. I 100% disagree. There was a time when people didn't think XSS was a serious vulnerability too. Most web developers in general are way too casual about a lot of attack vectors, and this is just one more example of that.

dsacco 10y ago
Okay, you can disagree, but the word "serious" only works comparatively. If every vulnerability is "serious", then none of them are, and the word loses its meaning and people stop responding to it. If not every vulnerability is "serious" but open redirection is, what do you call something like command injection or SQL injection? "Double-plus serious"? I understand that developers need to take security seriously, but that effort is undermined by being hyperbolic about vulnerability severity. No one is trying to say open redirection isn't a vulnerability, it's just not all that...well, serious. Fix it, but it's not a hair on fire problem.
- ebbv 10y ago
  I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. Your statement implies there's an unlimited number of these but there aren't. SQL injection is worse than open direction, but storing your passwords and CC data in plaintext and leaving your root account SSH-able on port 22 with no password is worse than SQL injection. Just because there's something worse than X doesn't mean X is not bad. The important thing here is open redirection is a stupid, optional behavior and there's no good reason for it. It shouldn't be there. Allowing it is just as stupid as allowing XSS. It's just lazy and sloppy and frankly inexcusable for a company like Google, which should be held to a much higher standard than a mom and pop web store that sells cat figurines.
  - dsacco 10y ago
    >> I would call any easily corrected behavior of your site that could lead a normal innocent user to being compromised is a serious vulnerability. So your stance is the first option, that basically any security vulnerability is serious. The grand majority of vulnerabilities are much simpler to fix than they are to find; once you find them, fixing them is generally straightforward. Given that we are using fundamentally different and incompatible definitions of the word "serious", we are obviously going to continue to disagree on this point. Perhaps it would help if I reframe this for you - there are vulnerabilities which warrant an on-call engineer being woken up at 4 am, and there are those which do not. Further, there are vulnerabilities which need to be fixed this week and those which can wait until the next feature release. If you don't like my use of the word "serious", hopefully you'll find that more agreeable. I don't think we are arguing over the same point anymore. You continue on to attack Google for having this vulnerability, but I don't think you have spent much time doing vulnerability research if you react that way about a company of Google's size. The sheer codebase alone basically guarantees every type of vulnerability will be found. Furthermore, being antagonistic about it in the way that you are is not conducive to recognition or remediation. Attempting to shame companies or engineering teams is counterproductive to developer awareness and education. At the end of the day, this is just a specialization and your job is not to be mean to them for making mistakes, it's to try to improve their understanding and help them resolve the issue while avoiding it in the future.

deleted 10y ago

[deleted]

secamo 10y ago

dsacco is correct in my mind. I work as a security researcher and penetration tester, and I would only include this in a client report as an informational or low risk vulnerability at best in a vulnerability assessment. In a penetration testing narrative I likely wouldn't even bring it up. Even if we look at the social engineering side of things, this is likely not something I'd bother with. There are so many social engineering attack vectors I would give priority to over this as an attacker. A hardline really does need to be drawn with regards to bug bounty programs, or we would constantly be chasing the proverbial rabbit.

deleted 10y ago
[deleted]