[Infowarrior] - Serious security flaw in OAuth and OpenID discovered

[Richard Forno]

Serious security flaw in OAuth and OpenID discovered

Malicious attackers can use the 'Covert Redirect' vulnerability in the OAuth 2.0 and OpenID open-source login systems to steal your personal info as well as redirect you to unsafe sites.

	• by Aloysius Low and Seth Rosenblatt
	• May 2, 2014 4:00 AM PDT

http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/#ftag=CAD590a51e

Following in the steps of the OpenSSL vulnerability Heartbleed, another major flaw has been found in popular open-source security software. This time, the holes have been found in the login tools OAuth and OpenID, used by many websites and tech titans including Google, Facebook, Microsoft, and LinkedIn, among others.

Wang Jing, a Ph.D student at the Nanyang Technological University in Singapore, discovered that the serious vulnerability "Covert Redirect" flaw can masquerade as a login popup based on an affected site's domain. Covert Redirect is based on a well-known exploit parameter.

For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication.

If a user chooses to authorize the login, personal data (depending on what is being asked for) will be released to the attacker instead of to the legitimate website. This can range from email addresses, birth dates, contact lists and possibly even control of the account.

Regardless of whether the victim chooses to authorize the app, they will then get redirected to a website of the attacker's choice, which could potentially further compromise the victim.

Wang says he has already contacted Facebook and has reported the flaw, but was told that the company "understood the risks associated with OAuth 2.0," and that "short of forcing every single application on the platform to use a whitelist," fixing this bug was "something that can't be accomplished in the short term."

Facebook isn't the only site affected. Wang says he has reported this to Google, LinkedIn and Microsoft, who gave him various responses on how they would handle the matter.

Google (which uses OpenID) told him that the problem was being tracked, while LinkedIn said that the company would publish a blog on the matter soon. Microsoft, on the other hand, said that an investigation had been done and that the vulnerability existed on a the domain of a third-party and not on its own sites.

"Patching this vulnerability is easier said than done. If all the third-party applications strictly adhere to using a whitelist, then there would be no room for attacks," said Wang.

"However, in the real world, a large number of third-party applications do not do this due to various reasons. This makes the systems based on OAuth 2.0 or OpenID highly vulnerable."

Jeremiah Grossman, founder and interim CEO at WhiteHat Security, a website security firm, agreed with Wang's findings after looking at the data.

"While I can't be 100 percent certain, I could have sworn I've seen a report of a very similar if not identical vulnerability in OAuth. It would appear this issue is essentially a known WONTFIX," Grossman said.

"This is to say, it's not easy to fix, and any effective remedies would negatively impact the user experience. Just another example that Web security is fundamentally broken and the powers that be have little incentive to address the inherent flaws."

Further corroborating Wang's findings is Chris Wysopal, CTO at programming code verification firm Veracode.

Wsyopal told CNET that it looks to be a "very real issue" and that OAuth 2.0 looks vulnerable to phishing and redirect attacks.

"Given the trust users put in Facebook and other major OAuth providers I think it will be easy for attackers to trick people into giving some access to their personal information stored on those service," he said.

Users who wish to avoid any potential loss of data should be careful about clicking links that immediately ask you to log in to Facebook or Google. Closing the tab immediately should prevent any redirection attacks.

While this issue isn't as severe as Heartbleed, it's relatively easy to do so unless the flaw gets patched, which according to Wang, is quite difficult to implement due to third-party sites having "little incentive" to fix the problem. Cost is a factor, as well as the view that the host company (such as Facebook) bears the responsibility for making the attacks appear more credible.

---
Just because i'm near the punchbowl doesn't mean I'm also drinking from it.