Slashdot Mirror
Account Registrations Enable 'Password Reset Man In The Middle' Attacks (helpnetsecurity.com)
"Attackers that have set up a malicious site can use users' account registration process to successfully perform a password reset process on a number of popular websites and messaging mobile applications, researchers have demonstrated." Orome1 quotes Help Net Security:
The Password Reset Man in the Middle attack exploits the similarity of the registration and password reset processes. To launch such an attack, the attacker only needs to control a website. To entice victims to make an account on the malicious website, the attacker can offer free access to a wanted resource. Once the user initiates the account registration process by entering their email address, the attacker can use that information to initiate a password reset process on another website that uses that piece of information as the username (e.g. Google, YouTube, Amazon, Twitter, LinkedIn, PayPal, and so on). Every request for input from that site is forwarded to the potential victim, and then his or her answers forwarded back to that particular site.
Interestingly, it can also beat two-factor authentication -- since the targeted user will still input the phone code into the man-in-the-middle site.
Interestingly, it can also beat two-factor authentication -- since the targeted user will still input the phone code into the man-in-the-middle site.
If you like this story, I recommend signing up for the daily computer science paper. I'm not affiliated, just like it. Lots of good stuff there.
"First they came for the slanderers and i said nothing."
Isn't this old news? I thought this was always the weakness with CAPTCHA codes: present the code to real users (e.g., for access to porn) and you get someone entering the code for you.
https://xkcd.com/792/
This illustrates the weakness of "security questions". Providing additional information to third party sites is never a good idea; the site should function with least amount of data as possible. A bank doesn't need to know what their customers' best childhood friends' names, or favorite colors are. I've always treated these as secondary passwords, generating a random string for each.
If I'm registering on somthing.com and get 2 factor request on google.com I won't approve it.
Quoting that article, "Adding a layer of SMS-based verification to your login process is certainly better than relying on a password alone.", because "Those attacks (...) likely require the attacker to figure out the user's cell phone number in addition to the password that they've stolen, guessed, or reused after being compromised in a data breach from another hacked service."
At least scan things You quote for support of Your claims.
Often enough, people no longer have access to the email address they used when they signed up a long time ago. So while "a link in an email" is the default password reset, most popular sites offer other mechanisms as well.
Comment removed based on user account deletion
That actually seems like a good defense.
"So long and thanks for all the fish."
Interestingly, it can also beat two-factor authentication -- since the targeted user will still input the phone code into the man-in-the-middle site.
You'd think that someone trying to sign up for AwesomePorno.com, who suddenly gets a text message from Google that says "The Gmail code you requested is 8926," when they didn't request any code from Gmail, might notice that something hinky is going on. But no, people are god damned idiots. No wonder we wound up with a failed reality show clown in the White House.
He's signing up for AwesomePorno.com despite the huge number of free no-signup-required porn sites out there, so he's already shown that he's not the sharpest tool in the shed.
I don't really understand this all that well, but it sounds kinda ... well ...awkward
Are you folks absolutely sure that using the Internet for anything other than entertainment, research, and casual conversation is prudent?
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
I would disagree with you if you were a protoss, but since you're a zergling you're alright
"First they came for the slanderers and i said nothing."
I know there's this idea that anything not encrypted is super vulnerable but really, then about what you are saying: How to you mount such an attack? Suppose that someone requests an account reset from Amazon and it is going to their Gmail account. Where do you propose to intercept the message? You think you can realistically hack in to the servers or network at either company? If not there you'd have to get in to one of the tier-1 transit providers. These are some pretty hard targets. Other than that the only thing you could target is the lines themselves. Of course it is a bit difficult to physically tap fiber, in a conduit, and is a bit conspicuous.
It is far less feasible to intercept plain text traffic than many geeks make it out to be. It is not impossible, a state actor can do it, or the ISPs themselves of course. But for J. Random Hacker? Pretty close to impossible. Particularly if you are talking e-mail which these days is normally only plain text between providers, and is sent encrypted to the end user. Getting to tap that traffic would be very difficult, and I'd argue someone that did would ahve higher value targets than a password reset e-mail.
Don't click links in your email....manually go directly to your related site's home page
Unless it's a password reset email, then clicking the link is safer.
Re-typing the confirmation code in to the MITM website is the only way this type of attack can work when a password reset requires an email confirmation. Clicking the link takes the man out of the middle.
Or not: You can always download that tool that allows you to write PHP by throwing cow-pats at the screen with your Wii-mote.
(There must be one: its the only way to explain the quality of most PHP code).
Sent from my ASR33 using ASCII
You still enter your second factor in the scam website thus providing them with authorization.
However since every website with two factor has its own two factor they can only target selected sites at a given time.
i thought once I was found, but it was only a dream.
...and always will work.
This works when creating an account, not just password resetting - it's just likely to be easier with password resetting because of the similarity of process between sites.
The only way to prevent this (under any protocol) is client identification against a list of known (not a priori) clients (e.g. published client certificates.)
If you want anonymity, then you're going to take the risk of being impersonated sadly...
Loading...
Have gnu, will travel.
This is why I don't create accounts or "log in" to websites. There should rarely be a need to create an account unless you're buying something or its your email.
The more accounts you create the greater "attack surface" you create for yourself .
How would you be prompted to enter the second code into the site? "Durp, you never set up 2 factor authentication, but go ahead and enter the SMS you get from Google into this form field on a non-Google site."? Or perhaps "Uh, open your authenticator application and enter the code for the entry attached to the email account you just gave us."? Or even "Use your dedicated hardware token for your bank."?
Why the FUCK is this modded insightful?
A link is a fucking link. You can type in any link into your browser manually. Of you can copy and paste the text of the link. Doing so makes NO difference. You end up at the same destination.
Clicking a link or manually navigating to some other page, then manually typing in a code is the same deal (actually a bit safer as the form data isn't exposed via the URL as in the link clicking/copying scenario). A MITM attack is useless if you're connected via SSL/TLS. (Unless you believe the MITM can break SSL/TLS, at which point you're fucked regardless.)
You're confused about the mod points because you don't understand.
This "MITM" isn't breaking SSL or TLS. They're relaying what you type in their websites signup form to the target websites password reset form.
If you type or copy/paste a verification code in the email you received from the target website that was triggered by the MITM, they have compromised your account.
If you click on the verification link in the email, they never receive the verification code, it gets submitted to the target site and becomes invalid. Your account is safe.
This vulnerability can be completely mitigated by not using security questions and not sending users verification codes, only sending them a verification link.
Lately, I've been noticing a lot of sites requiring an account even for a one time purchase.
If I'm just buying a ticket to your location, and the odds are I'm never going to visit your site again, then WHY THE F**K DO I NEED TO CREATE AN ACCOUNT?
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.