{"id":3309,"date":"2014-05-05T10:00:54","date_gmt":"2014-05-05T14:00:54","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=3309"},"modified":"2020-12-18T21:36:17","modified_gmt":"2020-12-18T17:36:17","slug":"facebook-openid-oauth-vulnerable","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/facebook-openid-oauth-vulnerable\/3309\/","title":{"rendered":"Keep Calm and Stay Vigilant, OpenID and OAuth are Vulnerable"},"content":{"rendered":"

Just a few weeks after the disturbing Heartbleed bug<\/a> discovery, an ordinary Internet citizen like you and me may need to be concerned with another seemingly widespread issue, and it has no easy fix. It is the exact definition of a \u201cCovert redirection\u201d bug, recently publicized by Wang Jing, a PhD student in mathematics at the Nanyang Technological University in Singapore. The issues were found inside popular Internet protocols OpenID and Oauth; the former is utilized when you log in to web sites using your existing login from Google, Facebook, LinkedIN, etc., and the latter comes into play when you authorize sites, apps or services with Facebook\/G+\/etc., without actually revealing your password and login to third-party sites. These two are typically used in conjunction, and as it turns out, may lead your information into the wrong hands.<\/p>\n

The threat<\/h2>\n

Our friends at Threatpost<\/a> have a more technical explanation of the issue, along with a link to the original research, but we\u2019ll skip unnecessary details and just describe the possible attack scenario and consequences. First, a user visits a malicious phishing site<\/a>, which has those typical \u201cLogin with Facebook\u201d buttons. A phishing site may closely resemble one of the popular 3rd<\/sup>-party services or disguise itself as an entirely new service. Once you click on the button, a real Facebook\/G+\/LI popup will appear, prompting the user to enter their login and password information to authorize the aforementioned (and probably reputable) service to access their user profile. Finally, the authorization to use the profile is sent to the wrong (phishing) site using improper redirection.<\/p>\n

First, a user visits a phishing site and tries to login with Facebook or other OpenID providers.<\/div>\n

At the end of the day, a cybercriminal receives a proper authorization (OAuth token) to access the victim\u2019s profile with whatever permissions the original application has \u2015 in the best case, it\u2019s just an access to basic user details; in the worst-case scenario, it is the ability to read contacts, send messages, etc.<\/p>\n

Is it fixed? Not really<\/h2>\n

This threat probably won\u2019t go away anytime soon, as the fix must be performed both on the provider side (Facebook\/LinkedIn\/Google, etc) and client side (third-party app or service). The OAuth protocol is still in beta, and various providers use different implementations, which vary in their ability to counteract the aforementioned attack scenario. LinkedIn was better positioned to implement the fix and took a more strict direction of handling things by requiring<\/a> every third-party developer to provide a list of proper redirects. As of now, every app using LinkedIn authorization is either safe or nonfunctional. Things are different at Facebook, which is unhappy to have both a much wider set of third-party apps and maybe older OAuth implementation. That\u2019s why Facebook reps told Jing that it \u201cisn\u2019t something that can be accomplished in the short term.\u201d<\/p>\n

There are many other providers, which seem to be vulnerable (check the picture below), so if you log in to some sites using these services, you must take action.<\/p>\n

\"Vulnerable-providers\"<\/a><\/p>\n

Your action plan<\/h2>\n

For the most cautious ones, the bulletproof solution would be giving up using OpenID and those handy \u201cLogin with\u2026\u201d buttons for a few months. You may also benefit from increased privacy, as using those logins from social networks enables much more efficient tracking of your online behavior and allows more and more sites to read your basic demographic data. To avoid the hurdle with memorizing tens or even hundreds of different logins for various sites, you may finally start using an efficient password manager<\/a>. Most services today are equipped with multi-platform clients and cloud sync to ensure you have access to your passwords on every device you own.<\/p>

For cautious users, the best solution would be giving up using Facebook\/Google login for a few months. #OpenID #CovertRedirect<\/p>Tweet<\/a><\/blockquote>\n

However, if you plan to continue using OpenID authorization, there is no immediate danger in doing so. You just have to be very vigilant and avoid any phishing scams<\/a> which typically start with some disturbing letter in your inbox or a provocative link on Facebook or other social network. If you log in to some service using Facebook\/Google\/etc., make sure you open the site of this service using a manually typed address or a bookmark, not the link from your emails or messengers. Double check the address bar to avoid visiting sketchy sites, and don\u2019t sign up for new services with OpenID, unless you are 100% sure that the service is reputable and you\u2019ve landed on the proper web site. In addition, use a safe browsing solution like Kaspersky Internet Security \u2015 Multi-Device<\/a>, which prevents your browser from visiting dangerous places, including phishing sites.<\/p>\n

This is just an ordinary exercise in caution, which every Internet user should perform on a daily basis. Phishing threats are widespread and effective, leading to every kind of digital property loss, including: credit cards numbers, email logins and so on. The \u201cCovert redirect\u201d bug in OpenID and OAuth is just one more reason to do it\u2015no exceptions allowed.<\/p>\n","protected":false},"excerpt":{"rendered":"

OpenID and OAuth are protocols responsible for those \u201cLogin with Facebook\u201d and \u201cAuthorize with Google\u201d buttons you see on almost every site nowadays. Of course, there is a hack for that™, but you don\u2019t need neither panic nor change your password. Read on for our simple action plan.<\/p>\n","protected":false},"author":32,"featured_media":3310,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1486,9],"tags":[20,22,611,609,608,76,610],"class_list":{"0":"post-3309","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"category-tips","9":"tag-facebook","10":"tag-google","11":"tag-kaspersky-internet-security-multi-device","12":"tag-oauth","13":"tag-openid","14":"tag-phishing","15":"tag-vulnerability"},"hreflang":[{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/facebook-openid-oauth-vulnerable\/3309\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/facebook-openid-oauth-vulnerable\/3422\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/facebook-openid-oauth-vulnerable\/3731\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/facebook-openid-oauth-vulnerable\/3833\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/facebook-openid-oauth-vulnerable\/3350\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/facebook-openid-oauth-vulnerable\/3935\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/facebook-openid-oauth-vulnerable\/4721\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/facebook-openid-oauth-vulnerable\/3558\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/facebook-openid-oauth-vulnerable\/3935\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/facebook-openid-oauth-vulnerable\/4721\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/facebook-openid-oauth-vulnerable\/4721\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/me-en.kaspersky.com\/blog\/tag\/facebook\/","name":"Facebook"},"_links":{"self":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/32"}],"replies":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=3309"}],"version-history":[{"count":5,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3309\/revisions"}],"predecessor-version":[{"id":17785,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/3309\/revisions\/17785"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/3310"}],"wp:attachment":[{"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=3309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=3309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/me-en.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=3309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}