Slashdot Mirror
Account Registrations Enable 'Password Reset Man In The Middle' Attacks (helpnetsecurity.com)
"Attackers that have set up a malicious site can use users' account registration process to successfully perform a password reset process on a number of popular websites and messaging mobile applications, researchers have demonstrated." Orome1 quotes Help Net Security:
The Password Reset Man in the Middle attack exploits the similarity of the registration and password reset processes. To launch such an attack, the attacker only needs to control a website. To entice victims to make an account on the malicious website, the attacker can offer free access to a wanted resource. Once the user initiates the account registration process by entering their email address, the attacker can use that information to initiate a password reset process on another website that uses that piece of information as the username (e.g. Google, YouTube, Amazon, Twitter, LinkedIn, PayPal, and so on). Every request for input from that site is forwarded to the potential victim, and then his or her answers forwarded back to that particular site.
Interestingly, it can also beat two-factor authentication -- since the targeted user will still input the phone code into the man-in-the-middle site.
Interestingly, it can also beat two-factor authentication -- since the targeted user will still input the phone code into the man-in-the-middle site.
This could help me divorce my worthless husband, ShanghaiBill.
You mean SMS two-factor authentication, I have a yubikey.
My best friend is |nbY/1*3C[H{*r8
Next...
I bathe in 91% alcohol and I drink 92%, nothing Trump nor Obama can throw at me will have any rational effect.
If you like this story, I recommend signing up for the daily computer science paper. I'm not affiliated, just like it. Lots of good stuff there.
"First they came for the slanderers and i said nothing."
Two-factor authentication based on SMS texts can be less secure than just a password because the SMSes can be redirected by the attacker.
"First they came for the slanderers and i said nothing."
Ramp up those Internet street smarts, and basic critical thinking skills.
Apply a sniff test for crying out loud. If something is too good to be true, it is. If the site is unclean in some way (weird URL, etc.), ditch it. Don't click links in your email....manually go directly to your related site's home page (and only if you already know it to be legit).
If you are a sucker, there are plenty of other ways you will get scammed. If you are not a sucker, you don't need to read about these kinds of attacks because you are already assuming that most of the Internet is trying this on you, and won't fall for them because your guard is always up.
But it is on YOU to smarten up and not be a sucker.
Interestingly, it can also beat two-factor authentication -- since the targeted user will still input the phone code into the man-in-the-middle site.
You'd think that someone trying to sign up for AwesomePorno.com, who suddenly gets a text message from Google that says "The Gmail code you requested is 8926," when they didn't request any code from Gmail, might notice that something hinky is going on. But no, people are god damned idiots. No wonder we wound up with a failed reality show clown in the White House.
Isn't this old news? I thought this was always the weakness with CAPTCHA codes: present the code to real users (e.g., for access to porn) and you get someone entering the code for you.
I enter my details to this website, they send them to another website password reset page, I sent sent a password reset email, I click the link in the email and get sent to the real website. I'm no longer at the attacking website.
This is after blindly clicking a link in an email with the subject of password reset from a website I'm not trying to access.
https://xkcd.com/792/
This kind of hungry hustle of an attack vector really deserves to be called more than a man-in-the-middle attack. More a man-on-the-outside-looking-in.
This illustrates the weakness of "security questions". Providing additional information to third party sites is never a good idea; the site should function with least amount of data as possible. A bank doesn't need to know what their customers' best childhood friends' names, or favorite colors are. I've always treated these as secondary passwords, generating a random string for each.
I use a different address for every site I register with.
If I'm registering on somthing.com and get 2 factor request on google.com I won't approve it.
Often enough, people no longer have access to the email address they used when they signed up a long time ago. So while "a link in an email" is the default password reset, most popular sites offer other mechanisms as well.
...for having read this. I award you no points, and may God have mercy on your soul.
But seriously - This is like saying that to steal your car, all I have to do is break into your house, wait for you to come home, bop you over the head, then take the keys to your car from your purse. OMG!!! We have found a new car vulnerability - let's panic! How many more of these inane stories do we have to read about InfoSec "researchers" getting erections from more-and-more incredibly convoluted "attacks".
If information wants to be stolen, there's way more simpler and easier ways to do it. Enough with this nonsense, please.
Comment removed based on user account deletion
I don't really understand this all that well, but it sounds kinda ... well ...awkward
Are you folks absolutely sure that using the Internet for anything other than entertainment, research, and casual conversation is prudent?
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
More complicated does not mean more secure. Often, the opposite is the case. You are not a security expert. Your two cents is not worth even that.
It may take some skill to write a program, but any damn fool can run one.
I know there's this idea that anything not encrypted is super vulnerable but really, then about what you are saying: How to you mount such an attack? Suppose that someone requests an account reset from Amazon and it is going to their Gmail account. Where do you propose to intercept the message? You think you can realistically hack in to the servers or network at either company? If not there you'd have to get in to one of the tier-1 transit providers. These are some pretty hard targets. Other than that the only thing you could target is the lines themselves. Of course it is a bit difficult to physically tap fiber, in a conduit, and is a bit conspicuous.
It is far less feasible to intercept plain text traffic than many geeks make it out to be. It is not impossible, a state actor can do it, or the ISPs themselves of course. But for J. Random Hacker? Pretty close to impossible. Particularly if you are talking e-mail which these days is normally only plain text between providers, and is sent encrypted to the end user. Getting to tap that traffic would be very difficult, and I'd argue someone that did would ahve higher value targets than a password reset e-mail.
"Interestingly, it can also beat two-factor authentication -- since the targeted user will still input the phone code into the man-in-the-middle site" - This is completely false.
When you perform two-factor authentication and get an SMS with a code from somewhere, you know where it came from.
If I'll try to register to maliciouswebsite.com, provide my phone number for authentication, and get an SMS with a code from Gmail, I'll know something is super fishy.
...and always will work.
This works when creating an account, not just password resetting - it's just likely to be easier with password resetting because of the similarity of process between sites.
The only way to prevent this (under any protocol) is client identification against a list of known (not a priori) clients (e.g. published client certificates.)
If you want anonymity, then you're going to take the risk of being impersonated sadly...
Loading...
Sending 2FA to a phone is MITM-able with this technique. People won't pay attention to whom sent them the code.
U2F tokens aren't phishable with this technique. Their willingness to attest is bound to an origin, so as long as you stick them into a friendly browser, you're safe.
There's no UI on the token itself, so it's not safe with an unfriendly browser, like a doorknob: if you used a U2F token to unlock your door, it might take over your GMail account instead.
Have gnu, will travel.
This is why I don't create accounts or "log in" to websites. There should rarely be a need to create an account unless you're buying something or its your email.
The more accounts you create the greater "attack surface" you create for yourself .
Lately, I've been noticing a lot of sites requiring an account even for a one time purchase.
If I'm just buying a ticket to your location, and the odds are I'm never going to visit your site again, then WHY THE F**K DO I NEED TO CREATE AN ACCOUNT?
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
At least on a security conscious person. Y'see, I haven't (for years,) used the same password on more than one site, NOR the same security challenge and answer questions and responses, which in fact are nonsense. My passwords I use a manager for, because I'd have no hope of remembering "f9cn1j(*3121jdsfd" or whatever, and in response to "What is your favorite food," I'll put something like "SmUldring tier fier wit skungz."
No one's going to guess THAT. Even if you captured ONE somehow, while I'm trying to log IN to an actual site, it would only give you that ONE.
So I'm not too worried about this.
This attack has been around for quite awhile in the form of "using your free mp3 download website to hack other captchas", but was mainly used to create numerous spam accounts.
When you request a password reset for most sites the site sends an email with a link to create a new password as opposed to sending a temporary password. The original site where the request was submitted from never provides a direct login box for using the new password.