Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What prevents the following vulnerability I found from being exploited?

news.ycombinator.com

Post reply on HN
Print view View original

11–19 of 19 posts

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#11

Post by vitalipom »

alp1n3_eth wrote: post #9

I think I understand the situation correctly, but please correct me if I'm wrong. You're essentially asking "How does realBank.com stop fakeBank.com from sending requests on behalf of the user to realBank.com"? The malicious site could go about a few ways of potentially using functionality based on what protections the real bank's site is using. If it's not protected against CSRF & JWTs aren't in use, it could send a…

The thing is that I claimed to have a solution and I even filed a patent for it. Some time later I understood I need many iterations to even understand if I’m right or wrong. The direction is OK, but I’m still trying to understand if I’m the right person to solve this problem: I am sending a secret via Email (which is a right direction), then to send and receive data to and from “bank.com” I send it to a Frontend JavaScript code that has access to this secret key (user clicks a link in the Email). The JavaScript resides on a subdomain of my service which is whitelisted via CORS.

If anyone would read this, could you please reflect?

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#12

Post by vitalipom »

efortis wrote: post #6

my-bank.com backend replays requests to bank.com Yes, that’s a phising technique. CORS, CSP, or CSFR tokens can’t prevent it. --- bank.com can mitigate it by blocking my-bank.com IPs --- This 2007 paper [1] is about the initial mitigation idea, which was using Extended Validation Certificates (EV SSL). The study showed that users didn't pay attention to the special UI address bar EV certs had. In 2018 Chrome removed…

Thank you for the reference! Would you mind to see if you can reflect on my solution idea which I’m questioning myself about? I filed a patent for it and mentioned it in a comment above. Please

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#13

Post by fragmede »

That's a regular MitM attack, just with, specifically, Angular. If you can convince someone to go to malicious-bank.com and log into it with their real credentials, you've successfully phished them. If you go a step further and show them the real information from the real website, thats going a step further, but by then it's game over already.

If the attacker's already convinced you to give them your username/password (and 2fa), why bother showing the victim a fake (Angular) website?

A password manager/passkey/yubikey protects against this by checking that the url is bank.com and not malicious-bank.com, but unsophisticated users fall for this attack every day.

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#15

Post by vitalipom »

fragmede wrote: post #13

That's a regular MitM attack, just with, specifically, Angular. If you can convince someone to go to malicious-bank.com and log into it with their real credentials, you've successfully phished them. If you go a step further and show them the real information from the real website, thats going a step further, but by then it's game over already. If the attacker's already convinced you to give them your username/passwor…

A bit loss of context. Angular was mentioned in the context of how servers serve Angular apps: if instead of server index.html server would serve a different whole url.

And my worries are mainly due to the solution I proposed (as a patent(!)) and later on abandoned.

I am wondering whether to invest in this my time and furthermore additional money.

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#16

Post by vitalipom »

NetworkPerson wrote: post #10

Honestly, I think less attackers go this route than a simple clone of the target website and logging of credentials people enter. Much easier phishing than trying to interact with the real website. Saw this for a bank recently and sent an abuse email to the phishing domain’s registrar. Maybe 4 hours later and the registrar had killed it.

Yes, but more smart people that visit a clear phishing website later on understand their mistake and change their password. If you could perform actual actions on a letsencrypt certificate website that perhaps has a slightly different url, you’d most probably would be less sceptic.

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#17

Post by fragmede »

vitalipom wrote: post #15
fragmede wrote: post #13

That's a regular MitM attack, just with, specifically, Angular. If you can convince someone to go to malicious-bank.com and log into it with their real credentials, you've successfully phished them. If you go a step further and show them the real information from the real website, thats going a step further, but by then it's game over already. If the attacker's already convinced you to give them your username/passwor…

A bit loss of context. Angular was mentioned in the context of how servers serve Angular apps: if instead of server index.html server would serve a different whole url. And my worries are mainly due to the solution I proposed (as a patent(!)) and later on abandoned. I am wondering whether to invest in this my time and furthermore additional money.

Angular can't change the underlying domain name. Instead of http://example.com/index.html it can change to eg http://example.com/bank.com.html as the URL, but it'll still have "example.com".

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#18

Post by vitalipom »

fragmede wrote: post #17
vitalipom wrote: post #15

Earlier quoted context omitted.

A bit loss of context. Angular was mentioned in the context of how servers serve Angular apps: if instead of server index.html server would serve a different whole url. And my worries are mainly due to the solution I proposed (as a patent(!)) and later on abandoned. I am wondering whether to invest in this my time and furthermore additional money.

Angular can't change the underlying domain name. Instead of http://example.com/index.html it can change to eg http://example.com/bank.com.html as the URL, but it'll still have "example.com".

Again, I haven’t yet tested it. But I’d like to hear what community has to say with relevance to that about my direction with the solution I’d been working on.

Re: Ask HN: What prevents the following vulnerability I found from being exploited?

#19

Post by efortis »

vitalipom wrote: post #12
efortis wrote: post #6

my-bank.com backend replays requests to bank.com Yes, that’s a phising technique. CORS, CSP, or CSFR tokens can’t prevent it. --- bank.com can mitigate it by blocking my-bank.com IPs --- This 2007 paper [1] is about the initial mitigation idea, which was using Extended Validation Certificates (EV SSL). The study showed that users didn't pay attention to the special UI address bar EV certs had. In 2018 Chrome removed…

Thank you for the reference! Would you mind to see if you can reflect on my solution idea which I’m questioning myself about? I filed a patent for it and mentioned it in a comment above. Please

Yes, MFA with a click-link mitigates it. But a pastable token wouldn't.

https://en.wikipedia.org/wiki/Multi-factor_authentication

Post reply on HN