3 ms·

This is an example of using the marketing lessons[1] for Heartbleed to over-promote a known issue that is actually accounted for IN the OAuth 2.0 spec. Not eve

• patio11 13y ago
  Dubbed "Covert Redirect," the flaw could enable phishing sites to grab a user's login information. I realize you write for a generalist audience, but this phrasing does not evince understanding of the vulnerability. Users can choose to trust third-party applications to do certain things on Facebook/Google/Twitter/etc on their behalf. This vulnerability allows an attacker who is not affiliated with that trusted third party to perform those same actions. Those actions include, but are not limited to, "share information about me with my trusted 3rd party." This is not related to phishing sites. At all. It is possible to compromise a user without ever needing to ask for their credentials (on either a phishing site or a legitimate site), because users are customarily logged into Facebook/Google/Twitter/etc. That's a major part of the attraction for using them as net-wide identity providers, both for third-party sites and for users. It's important to note, however, that in order to take advantage of this vulnerability in the first place, a user has to click on a link or visit a malicious website. Security researchers generally consider this to not be a meaningful hurdle, as you can induce people's browsers to load a URL without any action on their part. If you can post a cat photo, you can post an attack. Have you viewed a cat photo recently from someone who you wouldn't trust with operating your Facebook account? Well, if you've previously entrusted a third party to use your Facebook (or similar) account on your behalf and that third party has an open redirect on their website, that cat photo could have also operated your Facebook account to the same extent you permitted the third party to. To avoid offering up information to a malicious website, users should only log into Facebook or other services through sites that they trust. If a site looks sketchy, don't do it. Standard anti-phishing practices apply here. This will not, in fact, help. That's the point. You trust ESPN.com to not abuse you. You use their integration with Facebook. You diligently check your browser and are sure you're only looking at ESPN and Facebook. Everything goes perfectly. Three weeks later a cat photo on a website which is neither ESPN nor Facebook steals your information. Maybe a more motivational example is operating your Twitter account for you? Say you enter a contest on ESPN. ESPN might ask, as a condition of the contest, that you Tweet "ESPN: it's not on your cell phone #wegetsocialmedia." There exists a particular way to implement that which gives them the ability to tweet whatever they want through your account, but you might come to the semi-sensible decision that they're ESPN so they're clearly not going to do anything malicious with your Twitter account. 3 weeks later, you load a cat photo, and your followers start asking you why you suddenly are interested in promoting alternative takes on Middle Eastern geopolitics or encouraging them to buy male enhancement supplements.
  • filmgirlcw 13y ago
    Some good points all around -- I've made edits trying to better frame the scenario. >Generalist audience point That actually was a rephrasing of my original description. The point about malicious sites -- phishing sites -- is that those are the sites (or compromised sites) that will serve links with the bad redirects. Co-existing with an XSS flaw not-withstanding (which has happened before and is realistically the best vector to get to alter the links), I don't think it's unfair to frame this as something that happens as a result of clicking on a bad link from a site that is either malicious or has been hacked. Obviously, there are exceptions -- and I'll make that more clear -- but I'm seeing it framed as if "every Facebook login you click could be hijacked" -- and that's just not true. >To the ESPN point Right -- if ESPN gets hacked or an XSS flaw takes place to append their links and redirects happens -- that's definitely a real problem. That's why some of the onus is on ESPN, to make sure they define their URI redirects in OAuth 2.0. It's also why Facebook should make it an absolute requirement for using Facebook login. Not to mitigate the fact that this is a real flaw at all - but I think we can all agree this isn't some new discovery. It's a well-known problem. Calling this the new Heartbleed won't make it any better.