Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open redirects – a vulnerability class no one but attackers cares about

stevetabernacle.github.io

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Open redirects – a vulnerability class no one but attackers cares about

#11

Post by tptacek »

a1a wrote: post #9
tptacek wrote: post #5

I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…

Author here. Thanks for your comment. I think you have a valid point about users clicking anything. However I would only say that's the case if you send around 20 phishing mails. In a targeted attack you want to send one or two phishing mails and you wanna maximize your chances of success to avoid a reaction from the blue team. I agree that the impact is low compared to other vulnerabilities. It is definitely the cas…

Right, but a targeted phishing attack against an internal user is just as likely to rely on an application (or a facsimile of an application) you don't control, like a benefits management portal or something that supposedly authenticates through an SSO.

I guess if your argument is that there would be high value in eradicating open redirects wholesale, I sort of see your point. But the incremental value of eliminating one open redirect is marginal at best.

Re: Open redirects – a vulnerability class no one but attackers cares about

#12

Post by amenghra »

userbinator wrote: post #4

Open redirects are also used to prevent referrers from propagating through. In that sense, they're very useful for anonymisation.

You have never needed an open redirect for that (just an internal redirect page).

In the past, one solution was to HMAC the destination URL with a time component (i.e. the redirect is only valid for a short period of time).

Today, you can check the origin header when your user lands on the redirect page or just tell the browser what information you want in the referrer (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Re...).

Re: Open redirects – a vulnerability class no one but attackers cares about

#13

Post by quangio »

Open redirect alone doesn't look dangerous. But combining it with another vulnerabilities like OAuth misconfiguration -> account takeover. I wrote a blog about this common mistake some time ago: https://pwn.netlify.com/open-redirect-to-oauth-token-theft.h...

Re: Open redirects – a vulnerability class no one but attackers cares about

#14

Post by codezero »

If you ever get a third party penetration test, this is like, the first thing they find. To say "no one but attackers cares about," is pretty nonchalant – we immediately patched up this clearly bad attack vector, despite it not being extremely likely to manifest as a serious problem to us, because, like, you should just do that.

Re: Open redirects – a vulnerability class no one but attackers cares about

#15

Post by shittyadmin »

tptacek wrote: post #5

I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…

That's quite true, but I think the value in these attacks is that they work against more technical users than typical phishing attacks - I remember several years ago someone posted a link on a large technical subreddit which appeared to be to youtube.com.

It presented a page which claimed to be an age flagged video - at the time youtube was having many problems with age flagging videos - and sure enough many people tried to login to it - they looked at the "(youtube.com)" text on reddit, they looked at their browser when they first clicked the link, but they never noticed when the URL changed to offsite when they had to login. It never struck them that a legitimate youtube link could have sent them offsite.

The solution most of those people arrived was simple though: use password managers which will force some extra suspicion if the login page doesn't behave as expected.

EDIT: Found the link and discussion, https://old.reddit.com/r/programming/comments/bpy7h/think_yo...

By the numbers it looks like about 1/2 the people who made it to the sign in page made it to the submit page. That's a pretty good result especially given that it's a technical subreddit and people were primed with "think you're immune to phishing attacks"...

Re: Open redirects – a vulnerability class no one but attackers cares about

#18

Post by rocqua »

tptacek wrote: post #11
a1a wrote: post #9

Earlier quoted context omitted.

Author here. Thanks for your comment. I think you have a valid point about users clicking anything. However I would only say that's the case if you send around 20 phishing mails. In a targeted attack you want to send one or two phishing mails and you wanna maximize your chances of success to avoid a reaction from the blue team. I agree that the impact is low compared to other vulnerabilities. It is definitely the cas…

Right, but a targeted phishing attack against an internal user is just as likely to rely on an application (or a facsimile of an application) you don't control, like a benefits management portal or something that supposedly authenticates through an SSO. I guess if your argument is that there would be high value in eradicating open redirects wholesale, I sort of see your point. But the incremental value of eliminating…

There is also value in customer trust. If a customer gets burned by a Google.com link, they are going to check next time they see such a link. Google would be better of if customers felt 'oh, it is Google so it must be safe'.

Re: Open redirects – a vulnerability class no one but attackers cares about

#19

Post by edent »

They're also really useful for evading spam filters. I found[1] a bunch of government domains with open redirects.

Spammers were sending out emails containing links to `example.gov.uk/redirect?url=dodgy-viagra.ph` - and certain spam filters were trained to whitelist "trusted" domains.

You also see a lot of open redirect abuse on forums - especially where they're configured to only show the first few dozen characters of a link.

[1] https://www.openbugbounty.org/researchers/edent/

Re: Open redirects – a vulnerability class no one but attackers cares about

#20

Post by enjo »

arkadiyt wrote: post #10

Surprised the author doesn't mention oauth - open redirects are the achilles' heel of oauth flows and allow for full account takeovers. It is very common.

Very common in 2019? I haven't run across an OAuth provider in some time that isn't properly checking redirect_uri against at least a whitelist of domains (if not the full URL).

Is there another redirect attack I'm not aware of? The other attacks on redirect generally involve gaining access to some other page on the client you are attacking and using that as a redirect which the provider will often allow if it's only validating the domain. That's not really an open redirect, however...

Am I missing something?

Post reply on HN