8 ms·

Fraudsters are taking advantage of email aliases to get other people to pay for someone else's account. Example: 1) Fraudster create an account and put in a b

Fraudsters are taking advantage of email aliases to get other people to pay for someone else's account. Example: 1) Fraudster create an account and put in a bogus card number. 2) Fraudster changes account email address to joe.smith@gmail.com. joesmith@gmail.com already exists in Netflix's DB - but joe.smith@gmail.com does not, so Netflix is ok with this. 3) Netflix emails joe.smith@gmail.com and says "hey your card is bad, please update it" by clicking here. 4) The real joesmith@gmail.com receives the email, clicks the link and is taken directly to a "update your card screen" and types in their credit card information. 5) Fraudster has their Netflix account paid for by the real Joe Smith. Granted, Netflix could fix this by requiring a login before updating billing details. But the dot aliases in Gmail are a part of the scam.

SketchySeaBeast 8y ago
Yeah, the other link(1) is more interesting. That's still not exactly a world shattering level of fraud though. Unless they subscribe to the 4k package, then we're getting unreasonable. 1) https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user.html https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-t...
koolba 8y ago
Netflix would be at fault there for allowing the email change without confirmation. Rule #1 of security: trust nothing from the client!
- ben0x539 8y ago
  So add step 2.5: Netflix sends a confirmation mail and the victim confirms for the same reason as in step 4.
  - josteink 8y ago
    So basically Gmail broke internet email. Again.
    - lotsofpulp 8y ago
      If Gmail sends emails for first.last@gmail.com to firstlast@gmail.com, then I would hope Gmail wouldn't allow another account to be made with f.irstlast@gmail.com or fi.rstla.st@gmail.com or any other permutation of the dots (or lack of).
      - koolba 8y ago
        They don’t allow it. The user is at fault for validating their email address. Also Netflix gets partial responsibility for accepting email validation via a different browser session. Unfortunately it’s either that or have people constantly complain they can’t validate their emails from their phone yet browse on a different device. Middle ground may be IP address check so if you’re on the same WiFi it’ll work. Of course IPv6 kills that.
  - josho 8y ago
    Nope. If the user clicks a link in the email they won’t be able to log in to that account to confirm the change. If the user navigates to Netflix themselves they won’t have anything to confirm in their own account.
sandov 8y ago
It's more an issue of gmail not appropiately informing their users of the extra addresses that correspond to their inbox, it's not an intrinsic vulnerability of the feature, and it's not an issue of Netflix, or any other third party.
SteveNuts 8y ago
A few years ago I noticed an uptick in services sending out "magic links" that take you direct to their service, already signed in. I've always thought there has to be some sort of vulnerability in that, perhaps this is it?
- ggggtez 8y ago
  The fact that netflix lets you create an account without verifying you actually own the email address they are sending the token to is the real bug. Besides, even without a magic link, they could still phish you into clicking a link to a malicious page that performed a login-csrf which would have the same effect.
- chrisweekly 8y ago
  See eg auth0's passwordless login via email. Given standard password flows include email-based password reset, there's really no difference in security; either way, if someone owns your email, you're screwed. TFA does help mitigate this though.
tcgv 8y ago
Netflix can also solve this on their end by sanitizing gmail addresses before saving them, stripping all dots and discarding everything after the plus sign from the account name. Any attempt to submit additional gmail "dot addresses" would result in a violation of primary key constraint.
- matthewmacleod 8y ago
  This is, however, not a valid way to treat email addresses in general. At a company the size of Netflix, maybe it’s reasonable - but not generally. It might be better to look at solutions that actually fix the underlying issue - like requiring a login.
- josteink 8y ago
  Why should anyone expect or tolerate a email service (like Gmail) to exhibit such dangerous, non-standard behavior? Imagine what would happen if we let this kinda sloppiness play loose on DNS instead. Terrifying, right? So why do we allow google to mangle standard internet email?
  - ASalazarMX 8y ago
    Because that was a known feature since 2008 that helps making aliases on the fly. For example, you register on SomeForum as myemail+someforum@gmail.com, and if you ever receive spam on that address, you know it was SomeForum who sold email lists. This was a good thing when email lists were being sold without regulations. https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...
    - josteink 8y ago
      So every website everywhere on the internet which has anything to do with email will have to consider each and every hack which every email provider has done which deviates from Internet email standards, ever, before sending an email or registering an account or anything... or else the website is at fault if these standards-violations leads to security issues? Fuck that shit! Oh... We should only give Google and Gmail a free pass because they’re big? No, fuck that too. That’s not how internet standards and internet emailing works. It’s level playing field because everyone plays by the rules, and when you cause fuck-ups like this, it’s entirely on your base. Gmail is the one who needs fixing, not everyone else.
deleted 8y ago
[deleted]
judge2020 8y ago
The fault is shared between Gmail having dot addresses/plus aliases (barely known unless you see an article on it) and web developers, especially those at Netflix, not looking into how these services handle their email. It would be nice to know everyone followed the RFC, but our reality is far from that. This isn't just Gmail - outlook also has "plus aliases", and unless the web developer handles these you can simply sign up with "johnsmith+netflix@hotmail.com" and perform the same attack.
moltar 8y ago
Except that google won’t let you register joe.smith if joesmith exists. Google strips out dots before unique validation.

SketchySeaBeast 8y ago

Yeah, the other link(1) is more interesting. That's still not exactly a world shattering level of fraud though. Unless they subscribe to the 4k package, then we're getting unreasonable. 1) https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user.html https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-t...

koolba 8y ago

Netflix would be at fault there for allowing the email change without confirmation. Rule #1 of security: trust nothing from the client!

ben0x539 8y ago
So add step 2.5: Netflix sends a confirmation mail and the victim confirms for the same reason as in step 4.
- josteink 8y ago
  So basically Gmail broke internet email. Again.
  - lotsofpulp 8y ago
    If Gmail sends emails for first.last@gmail.com to firstlast@gmail.com, then I would hope Gmail wouldn't allow another account to be made with f.irstlast@gmail.com or fi.rstla.st@gmail.com or any other permutation of the dots (or lack of).
    - koolba 8y ago
      They don’t allow it. The user is at fault for validating their email address. Also Netflix gets partial responsibility for accepting email validation via a different browser session. Unfortunately it’s either that or have people constantly complain they can’t validate their emails from their phone yet browse on a different device. Middle ground may be IP address check so if you’re on the same WiFi it’ll work. Of course IPv6 kills that.
- josho 8y ago
  Nope. If the user clicks a link in the email they won’t be able to log in to that account to confirm the change. If the user navigates to Netflix themselves they won’t have anything to confirm in their own account.

sandov 8y ago

It's more an issue of gmail not appropiately informing their users of the extra addresses that correspond to their inbox, it's not an intrinsic vulnerability of the feature, and it's not an issue of Netflix, or any other third party.

SteveNuts 8y ago

A few years ago I noticed an uptick in services sending out "magic links" that take you direct to their service, already signed in. I've always thought there has to be some sort of vulnerability in that, perhaps this is it?

ggggtez 8y ago
The fact that netflix lets you create an account without verifying you actually own the email address they are sending the token to is the real bug. Besides, even without a magic link, they could still phish you into clicking a link to a malicious page that performed a login-csrf which would have the same effect.
chrisweekly 8y ago
See eg auth0's passwordless login via email. Given standard password flows include email-based password reset, there's really no difference in security; either way, if someone owns your email, you're screwed. TFA does help mitigate this though.

tcgv 8y ago

Netflix can also solve this on their end by sanitizing gmail addresses before saving them, stripping all dots and discarding everything after the plus sign from the account name. Any attempt to submit additional gmail "dot addresses" would result in a violation of primary key constraint.

matthewmacleod 8y ago
This is, however, not a valid way to treat email addresses in general. At a company the size of Netflix, maybe it’s reasonable - but not generally. It might be better to look at solutions that actually fix the underlying issue - like requiring a login.
josteink 8y ago
Why should anyone expect or tolerate a email service (like Gmail) to exhibit such dangerous, non-standard behavior? Imagine what would happen if we let this kinda sloppiness play loose on DNS instead. Terrifying, right? So why do we allow google to mangle standard internet email?
- ASalazarMX 8y ago
  Because that was a known feature since 2008 that helps making aliases on the fly. For example, you register on SomeForum as myemail+someforum@gmail.com, and if you ever receive spam on that address, you know it was SomeForum who sold email lists. This was a good thing when email lists were being sold without regulations. https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-more-from-your.html https://gmail.googleblog.com/2008/03/2-hidden-ways-to-get-mo...
  - josteink 8y ago
    So every website everywhere on the internet which has anything to do with email will have to consider each and every hack which every email provider has done which deviates from Internet email standards, ever, before sending an email or registering an account or anything... or else the website is at fault if these standards-violations leads to security issues? Fuck that shit! Oh... We should only give Google and Gmail a free pass because they’re big? No, fuck that too. That’s not how internet standards and internet emailing works. It’s level playing field because everyone plays by the rules, and when you cause fuck-ups like this, it’s entirely on your base. Gmail is the one who needs fixing, not everyone else.

deleted 8y ago

[deleted]

judge2020 8y ago

The fault is shared between Gmail having dot addresses/plus aliases (barely known unless you see an article on it) and web developers, especially those at Netflix, not looking into how these services handle their email. It would be nice to know everyone followed the RFC, but our reality is far from that. This isn't just Gmail - outlook also has "plus aliases", and unless the web developer handles these you can simply sign up with "johnsmith+netflix@hotmail.com" and perform the same attack.

moltar 8y ago

Except that google won’t let you register joe.smith if joesmith exists. Google strips out dots before unique validation.