Slashdot Mirror
Office 365, Amazon, Others Vulnerable To Exploit Microsoft Knew About In 2012
colinneagle writes "Ethical hacking professor Sam Bowne recently put a cookie re-use method to test on several major web services, finding that Office 365, Yahoo mail, Twitter, LinkedIn, Amazon, eBay, and WordPress all failed the security test. Both Amazon and eBay can be tied directly to your money via the method of payment you have on record. And, just for kicks, we tried it with Netflix. And it worked. Microsoft has apparently known that accounts can be hijacked since at least 2012 when The Hacker News reported the Hotmail and Outlook cookie-handling vulnerability, so Bowne was curious if Microsoft closed the hole or if stolen cookies could still be re-used. He claims he 'easily reproduced it using Chrome and the Edit This Cookie extension.'"
It looks like they're exporting, deleting and then reimporting cookies before the cookies are set to expire. They can then get back into the site they just had access to. I fail to see how this "exploit" isn't actually the expected behavior of a properly functioning login tracked with a cookie.
If a user has a website remember their login via a cookie, and I make a copy of that cookie and put it into my browser, I will be logged in as that user? I am shocked...
It doesn't take much to be considered an "hacking professor" now days, does it?
that's like saying, "hey, I can login using your account as long as I steal your password first."
That's a known exploit that Micro$oft has known about and REFUSED to fix for years!
by Mike Buddha -- Someday the mountain might get him, but the law never will.
Can someone please come up with a "best practices" for this? Say "This is how you log a browser user in, this is how to check if a given browser is a logged in user, this is how to log out a user?" (That last one is important, no browser provides a logout button for Basic Authentication) Is storing everything server side in a session (referenced by a session cookie) the best way to do this? What about mobile users, is their IP static throughout a session or does their IP change if they change cells?
The Authentication Cheat Sheet is a good start, but basically cuts off at "use SSL, require long passwords, and make authentication someone else's problem with single-sign-on." Does anyone really know or have they merely amassed years of experience doing what they think is right?
If I have been able to see further than others, it is because I bought a pair of binoculars.
So if I login to GMail with my phone and my desktop, if I log off on my desktop it should kill my phone too? How the hell is that better?
If you log in to GMail twice, you get two different cookies. In a sane world, when you hit "logout", the specific cookie gets invalidated and you have to log in again on that device if you want back in. Hotmail (seemingly unlike GMail) does not exist in a sane world.
Finally! A year of moderation! Ready for 2019?
No. When you login, your session cookie should have an ID unique to that browser session. When you logout, it should cancel that ID at the server side, so even if the cookie persists it would be invalid. It seems like many websites are implementing this functionality by just deleting the session cookie when you logout. That's a problem.
So if I login to GMail with my phone and my desktop, if I log off on my desktop it should kill my phone too? How the hell is that better?
Please DO NOT log out of your Gmail account.
It makes you more difficult to track.
Sincerely,
Your Government
"Kittens give Morbo gas!"
Is this entire article some kind of joke? If you have physical access to a machine and are able to "steal" the cookies from their logged in browser session, then on another machine replicate that browser session and utilize that same logged in cookie so that the site can't tell the difference between the machine you HAVE PHYSICAL LOGGED-IN ACCESS TO and the replicated session, so you're able to continue using the site? Isn't this behaviour "as intended"?
This would only be a "flaw" if another site could remotely copy my cookies and continue my session 'as me'. (Well, actually, I have Java installed, so they probably can *cough*). Otherwise, it's exactly how a logged in cookie is meant to work. The only tacit connection to "Microsoft" seems to be that "Microsoft, like some other companies.. have websites on the internet."
Actually, the fact that Microsoft requires re-authentication to make any account changes is actually a good thing. The article makes some excuse about "what's the use of that if they're already able to read the emails with the logged in cookie", to which I counter - YES, OR.. YOU KNOW.. READING THE EMAILS ON THE LOGGED IN SESSION YOU ALREADY HAVE ON THE ORIGINAL MACHINE IN FRONT OF YOU.
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
Not an exploit, just business as usual.
NSA praises Redmond for 'collaborative teamwork'
There are red faces in Redmond after Edward Snowden released a new batch of documents from the NSA's Special Source Operations (SSO) division covering Microsoft's involvement in allowing backdoor access to its software to the NSA and others.
Documents seen by The Guardian detail how the NSA became concerned when Microsoft started testing Outlook.com, and asked for access. In five months Microsoft and the FBI created a workaround that gives the NSA access to encrypted chats on Outlook.com. The system went live in December last year – two months before Outlook.com's commercial launch.
http://www.theregister.co.uk/2013/07/11/snowden_leak_shows_microsoft_added_outlookencryption_backdoor_for_feds/
Good lord are we REALLY gonna have to explain on every. damned. security. story. how having the source isn't magic? The "many eyes" myth is just that and just because a program or website is FOSS doesn't make it more secure? hell watch how easy it is to blow "many eyes" out of the water, ready?
Now we ALL know that Slashdot is one of the most FOSS loving websites there is,right? That while the global numbers of Linux users are around 0.9% we could easily hit double digits here, right? this is like Geeker heaven, yes? Okay here goes...show of hands, how many of you have done an extensive code audit on Libre Office? Gimp? Firefox? Anyone? Bueller?
NOW do you understand why simply having source means jack and squat? For many eyes to work IRL you'd have to have 1.- Enough guys with the requisite skills and experience to even SPOT the flaws, see the Obfuscated C contest as to why THAT is important, 2.- Those guys have nothing better to do than to scan and debug YOUR code all day, which considering how in demand highly skilled programmers are? Not very damned likely, and finally 3.- Have enough of them to keep up with the changes that when you are talking about FOSS is practically a torrent. hell I bet it would take a good year to do an extensive code audit of a large program like Libre office...how many releases did LO have last year? See the problem yet?
Having the code fixes ONE problem and one problem alone, and that is old versions being abandoned. If you have the code AND you have the skills OR the money to hire your own dev team than and ONLY then will that code be a life saver, the rest of the time, and especially when we are talking about security, which involves not just the program itself but the underlying OS and subsystems? yeah...not so much. Frankly if even 3% of the code in your average distro gets seen by anybody but the guys running the projects I'd frankly be amazed but thanks to the "many eyes" myth people think because something CAN happen it HAS happened. Well by that logic because theoretically an immortal CAN be born then there are immortals running the earth, but i really don't think I have to worry about a 400 year old Scotsman with a sword coming at me in the parking lot, do you?
ACs don't waste your time replying, your posts are never seen by me.
Has anyone studied the Firefox code, you ask. Yep, I have. I happen to be a security professional too. Have all those people who used Firefox as the basis for their browser studied the hell out of it? Yep.
We know Microsoft is full of NSA backdoors. Has any government backdoor EVER been found in any FOSS, at any time. Nope.
The insistence on continuing to believe the ridiculous out of fandom is rather curious. Certainly on some level you understand your "beliefs" are laughable, but you're just completely incapable of changing your thoughts, of learning.
You ignore one obvious truth. With FOSS no matter how unlikely someone will look at the code it actually is a possibility that it will happen. With proprietary software there is no chance in hell. None. Nada. Zip! All kinds of nastiness hidden away and everyone knows their little nasty secrets are secure behind closed source. Proprietary software guarantees this kind of stuff will without any doubt happen. FOSS gives you a chance at least.
> and make authentication someone else's problem with single-signon." Does anyone really know or have they merely amassed years of experience doing what they think is right?
I should know. I spent 17 years keeping ahead of the bad guys and ahead of the competition, developing a security system used by tens of thousands of sites. The thing is, there are a lot of ways to screw up authentication, and a lot of ways to screw up authorization. Professionals making security products screwed it up all the time, and we made two significant errors. We're arguably the best in the business, and still we made mistakes.
Therefore, "make it someone else's problem" isn't a bad answer, if someone else knows what they are doing. I'm not very careful with many things, but I'm darn careful with two - online authentication and explosives. I can answer any specific questions, but to try to cover the topic in a Slashdot post would be a lot like a post on how to make fireworks. There's not time or space to cover the topic properly. Feel free to post or email specific questions, though.
There are three modes of operation possible with Bitlocker. The most secure has had an exploit publicly known for five years. In that most secure mode, reading the disk is inconvenient, but entirely possible even for independent security people like myself. For a nation-state, it's trivial.
The other big advantage with FOSS is that the change and commit logs are publicly accessible. If you introduce a backdoor in a FOSS product you can't hide behind a corporation. Your own name is tied to that backdoor. This is a strong disincentive; decades of social, economic, and criminal studies prove that.