Slashdot Mirror
Nasty Security Flaw In OAuth, OpenID
jones_supa writes: "A notable security vulnerability has been discovered which impacts both OAuth and OpenID, which are software packages that provide a secure delegated access to websites. Wang Jing, a Ph.D student at the Nanyang Technological University in Singapore, discovered that the 'Covert Redirect' flaw can masquerade as a login popup based on an affected site's domain. Covert Redirect is based on a well-known exploit parameter. For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication. If a user chooses to authorize the login, personal data will be released to the attacker instead of to the legitimate website. Wang did already warn a handful of tech giants about the vulnerability, but they mostly dodged the issue. In all honesty, it is not trivial to fix, and any effective remedies would negatively impact the user experience. Users who wish to avoid any potential loss of data should be careful about clicking links that immediately ask you to log in to Facebook or Google, and be aware of this redirection attack."
Ehh...
First of all, this isn't new. Hell, it's in the RFC. In fact, the RFC specifically details and recommends protecting against it in several places.
This is an implementation problem, not really anything to do with OAuth 2.0 or OpenID-Connect. Authorization servers are supposed to match the redirect_uri against valid values that are registered by the client. This is inconvenient for redirecting users back to the right page, so some popular providers decided to match based on prefix or domain, instead. And some websites on the internet have open redirects (hard to believe, i know). If the client website's security is _really_ lousy^H^H^H^H^H lax, its OAuth2 callback module might also not validate the response URI when it gets the access code, and may even not strip the access code from the URI parameters when redirecting.
The service providers are supposed to require clients to register a full redirection callback. The clients can keep track of whatever page people are on with the state parameter. But those same clients, with that same terrible security, will probably get that wrong, too.
So, it's entirely a known problem, and what it boils down to is this: You can recommend best practices, but you can't fix stupid. That's why Google and Facebook are shrugging it off.
That said, if they performed some meager sanitization, it could go a long way to improve the situation.
The instant I saw a Facebook login on a non Facebook website, I assumed it was a phisher.
This phishing attack has been around as long as this flawed protocol has been around.
Move along, nothing to see here, everyone knew this.
God spoke to me
Some people just can't take a hint.
[Beta is unusable, unnecessary, and unwanted]
As a logged in user, I still get Classic view, but on a narrow but tall vertical monitor, Beta comments are completely unreadable for me. Thus, when beta hits, I will be a summary-only reader. (And might finally get around to creating an account on reddit.)
Yeah its sucks. Whats with this whitespace crap?
I've been seeing this a LOT on Facebook. I myself am not stupid enough to log in to a site I am already logged into, but this has bitten a whole lot of my less savvy "friends"! Seems to be a regular Phishing feature where there is slightly risque picture and when you click to see full size they want you to prove you are over 13 by logging in ! Hah! Not happening!
...you must come up with a better description of the problem.
I read all the sites linked to from the summary and the article and I am not even convinced there is a problem.