Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This link says it's from YouTube but it's not

youtube.com

Post reply on HN
Print view View original

41–50 of 60 posts

Re: This link says it's from YouTube but it's not

#41

Post by andrewcooke »

xtacy wrote: post #20
tednaleid wrote: post #15

This is a common exploit. So common that it's #8 on the 2010 OWASP top 10 most critical web application security risks: "Unvalidated Redirects and Forwards". http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Projec... Every web app developer should review these vulnerabilities before releasing their code to the world.

Interesting. Facebook had a similar exploit earlier but they seem to have solved it easily by attaching a hash to the redirect: site.com/redirect?l= &h=hash(secret,url)

it's better to call it a hmac - http://en.wikipedia.org/wiki/HMAC - since reinventing them using hashes can lead to weaknesses (see "design principles" on that page).

Re: This link says it's from YouTube but it's not

#42

Post by eli »

exit wrote: post #26
xtacy wrote: post #20

Earlier quoted context omitted.

Interesting. Facebook had a similar exploit earlier but they seem to have solved it easily by attaching a hash to the redirect: site.com/redirect?l= &h=hash(secret,url)

that doesn't seem to solve it. the youtube redirect also has a signature, but generating a signed link is trivial.

Good point. Clearly there's a pretty serious problem with however they're creating those hashes.

Re: This link says it's from YouTube but it's not

#43

Post by harshavr »

Phantom wrote: post #7
pchristensen wrote: post #4

Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.

Exactly! Imagine if your bank had such a redirect URL available, Phishing would be so simple.

Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.

Re: This link says it's from YouTube but it's not

#44

Post by bcl »

jluxenberg wrote: post #25
MichaelGG wrote: post #21

Earlier quoted context omitted.

It's not about technical exploits, it's about making it eassier to social engineer and phish. For instance, redirecting to a fake youtube login page. Even slightly more savvy users will look at the original link, click it, then click through and follow instructions. Single signon systems that have redirects aren't uncommon, so the user can be used to seeing that sort of behaviour. I'm surprised youtube has such a bas…

Isn't this what SSL is for, proving identity? In this case, even a cursory look at the URL would indicate that something was up. Sure, this makes fishing a little easier, but users need to watch out for themselves. It's a big bad world out there :)

SSL doesn't prove identity. It just proves that the connection is encrypted. CA's try to add a layer of trust on top of this with their different levels of certification, but that doesn't guarantee identity.

Re: This link says it's from YouTube but it's not

#45

Post by bcl »

deno wrote: post #22
bcl wrote: post #12

This is not new. Various 'recognized' websites have redirect urls that are not protected. Once the redirect is complete the site it properly identified. If you have to be afraid of what links you click on you are running the wrong software.

But the real danger is phising. You won't get a virus when you click, but you might trust the website you're redirected to and type in your password.

You should always check the URL in the browser before entering your secrets.

Re: This link says it's from YouTube but it's not

#46

Post by chacha102 »

IgorPartola wrote: post #35
chacha102 wrote: post #11

Earlier quoted context omitted.

Furthermore, I can see browsers detecting this type of behavior and prompting the user about it. If a browser sees an encoded URL in the query string, and then gets a location header to go to that URL, and that URL is not on the same domain, it would prompt the user that you are leaving that domain. I can't see many sites that are legitimate, and use redirection techniques that meet all of my criteria.

http://voice.google.com/ redirects to http://google.com/voice . Technically different domains, but I would be really annoyed if I had to confirm this every time. I suppose you could add a white list, but now we are just annoying people when they first start using a particular install of a browser.

No, I'm talking about seeing something like:

http://voice.google.com/?r=google.com/voice, where the resulting URL is inside the query_string

Re: This link says it's from YouTube but it's not

#47

Post by IgorPartola »

chacha102 wrote: post #46
IgorPartola wrote: post #35

Earlier quoted context omitted.

http://voice.google.com/ redirects to http://google.com/voice . Technically different domains, but I would be really annoyed if I had to confirm this every time. I suppose you could add a white list, but now we are just annoying people when they first start using a particular install of a browser.

No, I'm talking about seeing something like: http://voice.google.com/?r=google.com/voice , where the resulting URL is inside the query_string

So then we start obfuscating the URL parameters? Or what if google.com/voice is just one step in a series of redirects? What if some "clever" dude decides to protect against this and say base64 encode the r argument to "protect" his app?

Re: This link says it's from YouTube but it's not

#48

Post by abentspoon »

mrcharles wrote: post #9

I don't know a single non-technical but non-internet-ignorant user who wouldn't be suckered in by this. I've taught people how to scan for valid links, and now they can't even trust that.

On proggit, we just found that even techical, internet savvy users can be suckered in by this.

http://www.reddit.com/r/programming/comments/bpy7h/think_you...

1 in 5 attempted to sign in. The results are hardly scientific, but the comments are full of users who were fooled.

Re: This link says it's from YouTube but it's not

#49

Post by redcap »

abentspoon wrote: post #48
mrcharles wrote: post #9

I don't know a single non-technical but non-internet-ignorant user who wouldn't be suckered in by this. I've taught people how to scan for valid links, and now they can't even trust that.

On proggit, we just found that even techical, internet savvy users can be suckered in by this. http://www.reddit.com/r/programming/comments/bpy7h/think_you... 1 in 5 attempted to sign in. The results are hardly scientific, but the comments are full of users who were fooled.

Looks like google fixed this one.

Re: This link says it's from YouTube but it's not

#50

Post by Pistos2 »

ominous_prime wrote: post #32
lanaer wrote: post #19

Earlier quoted context omitted.

So it is important to also check the URL in your address bar _after_ you click, as well. This trick won’t be able to fake that.

But would you always catch it if you were redirected to www.youtube.com.you1ube.com/something? Or possibly worse - http://www.youtube.com⁄bad-site.com/something_else

When hovered, then clicked in Opera:

opera:illegal-url-24

Error!

Invalid URL

The URL http://www.youtube.com⁄bad-site.com/something_else contains characters that are not valid in the location they are found.

The reason for their presence may be a mistyped URL, but the URL may also be an attempt to trick you into visiting a Web site which you might mistake for a site you trust.

Post reply on HN