This link says it's from YouTube but it's not • Hacker News Board

Re: This link says it's from YouTube but it's not

#11

Post by chacha102 » Mon, Apr 12, 2010, 5:38 PM UTC

Phantom wrote: post #6

chacha102 wrote: post #3

It is technically a YouTube link, but it is redirecting to securitytube.net. I know this because the Internet I am on blocks YouTube, but not SecurityTube, so going directly to the redirect link works, but the YouTube link does not. At least that is what my browser says: http://www.youtube.com/redirect?username=digitalhook&q=h... Looks like someone found a YouTube exploit.

correct! Basic idea is to show how easy it is to use this simple redirect against users of social media sites. Most people on HN would have seen this link and trusted it to be from YouTube.

Furthermore, I can see browsers detecting this type of behavior and prompting the user about it.

If a browser sees an encoded URL in the query string, and then gets a location header to go to that URL, and that URL is not on the same domain, it would prompt the user that you are leaving that domain.

I can't see many sites that are legitimate, and use redirection techniques that meet all of my criteria.

Re: This link says it's from YouTube but it's not

#12

Post by bcl » Mon, Apr 12, 2010, 5:45 PM UTC

This is not new. Various 'recognized' websites have redirect urls that are not protected. Once the redirect is complete the site it properly identified.

If you have to be afraid of what links you click on you are running the wrong software.

Re: This link says it's from YouTube but it's not

#13

Post by sp332 » Mon, Apr 12, 2010, 5:47 PM UTC

Phantom wrote: post #5

duck wrote: post #2

This title makes me definitely not want to click it.

Can you suggest something better?

Say where it is sending you, not just where it's not sending you.

Re: This link says it's from YouTube but it's not

#14

Post by jerf » Mon, Apr 12, 2010, 5:50 PM UTC

Phantom wrote: post #5

duck wrote: post #2

This title makes me definitely not want to click it.

Can you suggest something better?

It may suffice to point out in the comments that it redirects to http://securitytube.net/Social-Engineering-Attacks-using-Sim... . (As of this posting nobody else has posted this yet.)

Also, despite having "video" in the URL, the text says all you need to know. I don't think very many people around here will have a hard time figuring out how this happened. I don't need a video.

Re: This link says it's from YouTube but it's not

#15

Post by tednaleid » Mon, Apr 12, 2010, 5:51 PM UTC

This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards".

http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec...

Every web app developer should review these vulnerabilities before releasing their code to the world.

Re: This link says it's from YouTube but it's not

#16

Post by sparkiegeek » Mon, Apr 12, 2010, 5:52 PM UTC

https://www.google.com/accounts/CheckCookie?continue=http%3A...

This link looks like it's from google.com but it's not.

Incidentally I think this only works if you're currently signed in to a Google account, oh yeah it's bouncing from an HTTPS address as well.

Re: This link says it's from YouTube but it's not

#17

Post by johnrob » Mon, Apr 12, 2010, 5:53 PM UTC

I wonder how many sites have a similar redirect feature for post-login pages instead of outbound click tracking. This feature makes it easy to login from any page, and immediately return to the page upon success. How many sites don't validate the full url before redirecting? Scary thought...

Re: This link says it's from YouTube but it's not

#18

Post by sparkiegeek » Mon, Apr 12, 2010, 5:58 PM UTC

chacha102 wrote: post #8

Phantom wrote: post #6

Earlier quoted context omitted.

correct! Basic idea is to show how easy it is to use this simple redirect against users of social media sites. Most people on HN would have seen this link and trusted it to be from YouTube.

This is why redirect links should limit themselves to relative URLs, or limit it to a whitelisted set of domains. (Can anyone think of downsides to limiting yourself to relative URLs or a whitelist of domains?) It is very interesting that Youtube has this vulnerability. Almost every time I implement something like this, I double check the domain name. (This is really easy in PHP)

The redirect I found on https://www.google.com seems like it did have a whitelist. Luckily youtube.com was on the whitelist, so I could re-use the exploit from there. So even whitelists aren't totally safe (and YouTube isn't using the redirect for known friendly sites - seems to be more for tracking purposes).

http://news.ycombinator.com/item?id=1259844 for the google.com URL

Re: This link says it's from YouTube but it's not

#19

Post by lanaer » Mon, Apr 12, 2010, 6:01 PM UTC

pchristensen wrote: post #4

Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.

So it is important to also check the URL in your address bar _after_ you click, as well. This trick won’t be able to fake that.

Re: This link says it's from YouTube but it's not

#20

Post by xtacy » Mon, Apr 12, 2010, 6:09 PM UTC

tednaleid wrote: post #15

This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards". http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec... Every web app developer should review these vulnerabilities before releasing their code to the world.

Interesting. Facebook had a similar exploit earlier but they seem to have solved it easily by attaching a hash to the redirect:

site.com/redirect?l=&h=hash(secret,url)