Slashdot Mirror
Office 365, Amazon, Others Vulnerable To Exploit Microsoft Knew About In 2012
colinneagle writes "Ethical hacking professor Sam Bowne recently put a cookie re-use method to test on several major web services, finding that Office 365, Yahoo mail, Twitter, LinkedIn, Amazon, eBay, and WordPress all failed the security test. Both Amazon and eBay can be tied directly to your money via the method of payment you have on record. And, just for kicks, we tried it with Netflix. And it worked. Microsoft has apparently known that accounts can be hijacked since at least 2012 when The Hacker News reported the Hotmail and Outlook cookie-handling vulnerability, so Bowne was curious if Microsoft closed the hole or if stolen cookies could still be re-used. He claims he 'easily reproduced it using Chrome and the Edit This Cookie extension.'"
The year we ban non open sourced softwares as a global threat to humanity.
It looks like they're exporting, deleting and then reimporting cookies before the cookies are set to expire. They can then get back into the site they just had access to. I fail to see how this "exploit" isn't actually the expected behavior of a properly functioning login tracked with a cookie.
but you have to steal the cookies first?
that's like saying, "hey, I can login using your account as long as I steal your password first."
If a user has a website remember their login via a cookie, and I make a copy of that cookie and put it into my browser, I will be logged in as that user? I am shocked...
It doesn't take much to be considered an "hacking professor" now days, does it?
That's a big deal only if the sites are using plain unencrypted html. In that case your cookies are visible to anyone on the same network (i.e. same coffee shop) so anyone can impersonate you.
So if I login to GMail with my phone and my desktop, if I log off on my desktop it should kill my phone too? How the hell is that better?
Your hair look like poop, Bob! - Wanker.
Can someone please come up with a "best practices" for this? Say "This is how you log a browser user in, this is how to check if a given browser is a logged in user, this is how to log out a user?" (That last one is important, no browser provides a logout button for Basic Authentication) Is storing everything server side in a session (referenced by a session cookie) the best way to do this? What about mobile users, is their IP static throughout a session or does their IP change if they change cells?
The Authentication Cheat Sheet is a good start, but basically cuts off at "use SSL, require long passwords, and make authentication someone else's problem with single-sign-on." Does anyone really know or have they merely amassed years of experience doing what they think is right?
If I have been able to see further than others, it is because I bought a pair of binoculars.
Is not that Windows have a vulnerability, from time to time a vulnerability is found in a lot of systems. The problem is that they didn't fixed, on pourpose, so you can get hacked. That they held that bug since a year ago gives a hint on how safe you should feel with it.
Is this entire article some kind of joke? If you have physical access to a machine and are able to "steal" the cookies from their logged in browser session, then on another machine replicate that browser session and utilize that same logged in cookie so that the site can't tell the difference between the machine you HAVE PHYSICAL LOGGED-IN ACCESS TO and the replicated session, so you're able to continue using the site? Isn't this behaviour "as intended"?
This would only be a "flaw" if another site could remotely copy my cookies and continue my session 'as me'. (Well, actually, I have Java installed, so they probably can *cough*). Otherwise, it's exactly how a logged in cookie is meant to work. The only tacit connection to "Microsoft" seems to be that "Microsoft, like some other companies.. have websites on the internet."
Actually, the fact that Microsoft requires re-authentication to make any account changes is actually a good thing. The article makes some excuse about "what's the use of that if they're already able to read the emails with the logged in cookie", to which I counter - YES, OR.. YOU KNOW.. READING THE EMAILS ON THE LOGGED IN SESSION YOU ALREADY HAVE ON THE ORIGINAL MACHINE IN FRONT OF YOU.
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
Not an exploit, just business as usual.
NSA praises Redmond for 'collaborative teamwork'
There are red faces in Redmond after Edward Snowden released a new batch of documents from the NSA's Special Source Operations (SSO) division covering Microsoft's involvement in allowing backdoor access to its software to the NSA and others.
Documents seen by The Guardian detail how the NSA became concerned when Microsoft started testing Outlook.com, and asked for access. In five months Microsoft and the FBI created a workaround that gives the NSA access to encrypted chats on Outlook.com. The system went live in December last year – two months before Outlook.com's commercial launch.
http://www.theregister.co.uk/2013/07/11/snowden_leak_shows_microsoft_added_outlookencryption_backdoor_for_feds/
Both http and mixed http/https site with no issues. Once user is logged out, cookies don't work any more.
If I understand correctly, session cookies have no server-side expiration. If someone manage to steal such a cookie, for instanc uwing a spyware, that person gets access to the account forever.
Handling session expiration seems an easy thing to do, so why isn't it done here? I wonder if cloud infrastructure is not a problem here: with a highly distributed setup, it may not be trivial to make all nodes aware that a session expired
Has anyone studied the Firefox code, you ask. Yep, I have. I happen to be a security professional too. Have all those people who used Firefox as the basis for their browser studied the hell out of it? Yep.
We know Microsoft is full of NSA backdoors. Has any government backdoor EVER been found in any FOSS, at any time. Nope.
The insistence on continuing to believe the ridiculous out of fandom is rather curious. Certainly on some level you understand your "beliefs" are laughable, but you're just completely incapable of changing your thoughts, of learning.
I haven't checked IE9, but in IE 6, 7, and 8 a bit of JavaScript could steal your cookies. I'm sure it can be done in 9 as well, I just haven't had the need to see how.
Other browsers have a slightly better history.
Old news. They've been collaborating since way back over a decade ago at least. This from Win98.
http://www.cnn.com/TECH/computing/9909/03/windows.nsa.02/
I dislike Microsoft as much as the next person, but how on earth is it Microsoft's fault that all these non-Microsoft sites do not invalidate the security token inside the session cookie when receiving a "Log out" command? All I can infer is that a number of Microsoft services (hotmail, outlook.com, office 365) were vulnerable in 2012, Microsoft was notified of it, and (if I interpret TFA correctly) didn't fix it. Is it now Microsoft's job to start probing other people's websites (Twitter, LinkedIn, Amazon, eBay, WordPress, NetFlix) for the same type of vulnerabilty and somehow force them to fix the vulnerability it didn't find worth fixing itself?
Microsoft Bitlocker and Apple FileVault are the two most popular forms of disk encryption used. I'm pretty sure the NSA can access any Bitlocker drive. Without question they can access FileVault if you uploaded your key to Apple for safe keeping.
Life is not for the lazy.
> and make authentication someone else's problem with single-signon." Does anyone really know or have they merely amassed years of experience doing what they think is right?
I should know. I spent 17 years keeping ahead of the bad guys and ahead of the competition, developing a security system used by tens of thousands of sites. The thing is, there are a lot of ways to screw up authentication, and a lot of ways to screw up authorization. Professionals making security products screwed it up all the time, and we made two significant errors. We're arguably the best in the business, and still we made mistakes.
Therefore, "make it someone else's problem" isn't a bad answer, if someone else knows what they are doing. I'm not very careful with many things, but I'm darn careful with two - online authentication and explosives. I can answer any specific questions, but to try to cover the topic in a Slashdot post would be a lot like a post on how to make fireworks. There's not time or space to cover the topic properly. Feel free to post or email specific questions, though.
There are three modes of operation possible with Bitlocker. The most secure has had an exploit publicly known for five years. In that most secure mode, reading the disk is inconvenient, but entirely possible even for independent security people like myself. For a nation-state, it's trivial.
The reality is that most of this stuff was and is fine so long as it remains on private systems. A hundred million computers scattered all over the planet are a lot harder to target then a few centralized datacenters.
MS office has had issues with security for ages. But all of it was controllable because you could just "not" download viruses. Or "not" horribly infect yourself with malware. But when its all on the cloud that isn't an option anymore. The hackers have ONE target and when they penetrate it... they f' over EVERYONE using the system. That's a big difference.
I get what MS wants to do here... they want to get people to stop pirating their software by using a cloud based software system.
The problem is that their model is less useful and actually puts a burden of responsibility upon them to secure our data that they're not willing or able satisfy. As a result, I think you'll find a lot of these companies retreating from this idea as it becomes clear that customers won't put up with it.
Your choice MS... how little market share do you want? Because it can go lower.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
This type of cookie behavior is not at the OS or even web server level. Microsoft has nothing to do with this. This type of interaction will be at the application level and up to the individual websites to handle. Its been widely known that many sites have not bothered to secure their cookies in this way. But this isn't something you can blame on Microsoft.
This shouldn't surprise anyone. Microsoft has never bothered to fix the flaw in Outlook where opening attachments directly from an email rather than saving them first will eventually fill a temp directory and prevent you from opening any more attachments. This has been in existence since Outlook came out.
Once the number of temp files reaches about 100 you're screwed until you root through the system and find the directory and clear it.
The issue, its symptoms and recommendations:
http://www.howto-outlook.com/faq/securetemp.htm
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Who designed SeLinux? The NSA: Do YOU trust it now?? What makes ME laugh, is guys like you - you really do: How "security pro" are you without tools coders MAKE for you to USE, "user with a better password"??? You're not.
So, OP asked for a show of hands in a FOSS-rich arena and got one person. That seems to have made his point for him.
The insistence on continuing to believe the ridiculous out of fandom is rather curious.
It's not fandom, it's self-interest. hairyfeet earns his money by fixing Windows computers. If Windows wasn't such a user-hostile, poorly written, feature-poor OS hairyfeet would earn a lot less money. He knows which side of his bread is buttered. If Winfows computers didn't constantly get infected a lot of glaziers would be out of work (yes, I'm referring to the brokwn window fallacy).
He knows Windows is a piece of shit, but it's against his self-interest to admit it.
Don't forget to mention NSA's role in AES, which is the De facto encryption for the entire world.