4 ms·

I think all this link does is redirects to the 'Reset password' page (i.e. https://id.heroku.com/account/password/reset https://id.heroku.com/account/password/r

by nomilk 5y ago

I think all this link does is redirects to the 'Reset password' page (i.e. https://id.heroku.com/account/password/reset https://id.heroku.com/account/password/reset), with email address pre-populated, then shows a button to email the user a separate reset password link. So I think the lack of 's' in http in the original link doesn't matter. If I'm wrong, could you please explain why (I am reasoning as best I can, and am not an expert, and keen to learn).

Froogo 5y ago
I guess a concern could be that since this URL is insecure, it could redirect you wherever assuming your network is compromised (either their malicious URL, or even HTTP for the legit Heroku site assuming you don't have HSTS on it). Obviously, you've checked the URL and seen that it's legit after, but realistically you should expect a legit email to not be feeding you a potentially insecure link.
- tialaramex 5y ago
  Right. If you're on top of things then using plain HTTP links here didn't make anything worse, but if you aren't it's yet another unnecessary gift to bad guys because it's yet another opportunity for customers to get phished.
  - Froogo 5y ago
    Sorry, meant if the end user's network was compromised, not the server's. Whether or not you're on top of your game, HTTP leaves you vulnerable to MITM attacks[0]. So this would leave the end user vulnerable to any of these attacks even assuming Heroku has everything else perfect. [0] https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack
eastern 5y ago
You are right, by itself it doesn't matter. All Heroku users should be smart enough to figure this out themselves. However, Heroku should also be smart enough to figure out that all links should be https and servers should have valid certificates. For a company to make such basic security-related mistakes while in the middle of a bad security incident doesn't look good, to put it politely. It sort of explains how they got where they are.
rabite 5y ago
With a non-HTTPS link, an attacker could trivially MITM the connection and forward it to a domain like id.hеrоku.com instead with a completely valid SSL cert with lock symbol. In case you can't realize, that domain is made up of unicode homoglyphs and would be nearly completely indistinguishable from the real heroku.com in some browsers. They could have a website resting on that domain that is indistinguishable from the normal heroku website and simply acts as a form proxy, relaying the real credentials provided by the user to the actual heroku website, performing the password reset successfully while storing the legitimate credentials permanently and additionally scraping the user's cookie to utilize their access to the panel post facto even if the user has 2FA authentication enabled. It's a monumental fuckup.
- nomilk 5y ago
  I certainly couldn't tell the difference, wow.. id.hеrоku.com and id.heroku.com look identical to me. I see the problem now. How hard is it for an attacker to do a MITM? Would the attacker need physical access to the user's wifi router?
  - rabite 5y ago
    pay for colocation with BGP access with a fake ID or compromise any BGP-announcing router in the entire world (I've found cisco routers with announce access, with default credentials, on networks that don't do any kind of prefix filtering many times before) and you can trivially MITM most any network in the world with very minimal impact. I recommend you watch to Kapela and Pilosov's talk from DEFCON 16 to see how easy it is: https://www.youtube.com/watch?v=oWdjsfsS_Do https://www.youtube.com/watch?v=oWdjsfsS_Do or if you don't want to do it via BGP announcement you can just compromise any of the devices that are along the route between the client and the server. BGP is the rocket launcher of worldwide circuit compromise, but there's many other guns you can pick up
    - nomilk 5y ago
      Thanks for the recommendation, was very interesting. 14 years old though, things would have changed since, I hope?

by nomilk 5y ago

Froogo 5y ago

I guess a concern could be that since this URL is insecure, it could redirect you wherever assuming your network is compromised (either their malicious URL, or even HTTP for the legit Heroku site assuming you don't have HSTS on it). Obviously, you've checked the URL and seen that it's legit after, but realistically you should expect a legit email to not be feeding you a potentially insecure link.

tialaramex 5y ago
Right. If you're on top of things then using plain HTTP links here didn't make anything worse, but if you aren't it's yet another unnecessary gift to bad guys because it's yet another opportunity for customers to get phished.
- Froogo 5y ago
  Sorry, meant if the end user's network was compromised, not the server's. Whether or not you're on top of your game, HTTP leaves you vulnerable to MITM attacks[0]. So this would leave the end user vulnerable to any of these attacks even assuming Heroku has everything else perfect. [0] https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack

eastern 5y ago

You are right, by itself it doesn't matter. All Heroku users should be smart enough to figure this out themselves. However, Heroku should also be smart enough to figure out that all links should be https and servers should have valid certificates. For a company to make such basic security-related mistakes while in the middle of a bad security incident doesn't look good, to put it politely. It sort of explains how they got where they are.

rabite 5y ago

With a non-HTTPS link, an attacker could trivially MITM the connection and forward it to a domain like id.hеrоku.com instead with a completely valid SSL cert with lock symbol. In case you can't realize, that domain is made up of unicode homoglyphs and would be nearly completely indistinguishable from the real heroku.com in some browsers. They could have a website resting on that domain that is indistinguishable from the normal heroku website and simply acts as a form proxy, relaying the real credentials provided by the user to the actual heroku website, performing the password reset successfully while storing the legitimate credentials permanently and additionally scraping the user's cookie to utilize their access to the panel post facto even if the user has 2FA authentication enabled. It's a monumental fuckup.

nomilk 5y ago
I certainly couldn't tell the difference, wow.. id.hеrоku.com and id.heroku.com look identical to me. I see the problem now. How hard is it for an attacker to do a MITM? Would the attacker need physical access to the user's wifi router?
- rabite 5y ago
  pay for colocation with BGP access with a fake ID or compromise any BGP-announcing router in the entire world (I've found cisco routers with announce access, with default credentials, on networks that don't do any kind of prefix filtering many times before) and you can trivially MITM most any network in the world with very minimal impact. I recommend you watch to Kapela and Pilosov's talk from DEFCON 16 to see how easy it is: https://www.youtube.com/watch?v=oWdjsfsS_Do https://www.youtube.com/watch?v=oWdjsfsS_Do or if you don't want to do it via BGP announcement you can just compromise any of the devices that are along the route between the client and the server. BGP is the rocket launcher of worldwide circuit compromise, but there's many other guns you can pick up
  - nomilk 5y ago
    Thanks for the recommendation, was very interesting. 14 years old though, things would have changed since, I hope?