Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open redirects – a vulnerability class no one but attackers cares about

stevetabernacle.github.io

Post reply on HN
Print view View original

21–30 of 43 posts

Re: Open redirects – a vulnerability class no one but attackers cares about

#21

Post by wtracy »

rocqua wrote: post #18
tptacek wrote: post #11

Earlier quoted context omitted.

Right, but a targeted phishing attack against an internal user is just as likely to rely on an application (or a facsimile of an application) you don't control, like a benefits management portal or something that supposedly authenticates through an SSO. I guess if your argument is that there would be high value in eradicating open redirects wholesale, I sort of see your point. But the incremental value of eliminating…

There is also value in customer trust. If a customer gets burned by a Google.com link, they are going to check next time they see such a link. Google would be better of if customers felt 'oh, it is Google so it must be safe'.

That might not be an issue for Google, but I could see it being a big problem for a company that relies heavily on projecting a "family friendly" image (think Disney).

Re: Open redirects – a vulnerability class no one but attackers cares about

#22

Post by bjornedstrom »

tptacek wrote: post #5

I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…

As a security professional I agree. When I worked at companies with bug bounties I always considered open redirects in the lamest category of bugs, unless the open redirect was cleverly combined with other issues, which was very rare.

Re: Open redirects – a vulnerability class no one but attackers cares about

#23

Post by wtracy »

geofft wrote: post #7
wtracy wrote: post #3

A decade ago people were using Google redirects to lure people into visiting shock sites. Back then, it seemed reasonable to not consider this a real security flaw. Now that everyone has a Google account, the possibility of credential theft seems like something worth taking seriously. At the very least, either host the redirect on a domain that is clearly distinct from the domain users log into, or ignore the destina…

> Now that everyone has a Google account, the possibility of credential theft seems like something worth taking seriously. Not sure I follow - is the idea to redirect from google.com to an attacker's site that spoofs the Google login page? I think we'll get more mileage out of solving that with origin-aware authentication mechanisms (password managers, U2F, WebAuthn, etc.) and perhaps address bars that show the eTLD+…

Relying on your customers to use password managers to protect themselves is not very useful in the Eternal September age of the internet. (I do see your point that a Google redirect is only marginally more likely to be effective for phishing than a link to something like goegle.com.)

Everything else in your comment is spot on.

Re: Open redirects – a vulnerability class no one but attackers cares about

#26

Post by bennofs »

enjo wrote: post #20
arkadiyt wrote: post #10

Surprised the author doesn't mention oauth - open redirects are the achilles' heel of oauth flows and allow for full account takeovers. It is very common.

Very common in 2019? I haven't run across an OAuth provider in some time that isn't properly checking redirect_uri against at least a whitelist of domains (if not the full URL). Is there another redirect attack I'm not aware of? The other attacks on redirect generally involve gaining access to some other page on the client you are attacking and using that as a redirect which the provider will often allow if it's only…

If they check the domain, chain it with another open redirect in the same domain.

Re: Open redirects – a vulnerability class no one but attackers cares about

#27

Post by TomAnthony »

The problem is that often Open Redirects can be leveraged in unexpected ways, beyond the conventional attacks listed.

I have previously been awarded a bug bounty by Google for an issue that leveraged open redirects on victim sites to hijack their link equity (PageRank): http://www.tomanthony.co.uk/blog/google-login-hijack/

It would have allowed a non-trivial financial impact on victim companies.

Secondly, I submitted an issue to Google which leveraged open redirects on their properties to hijack the login flow (i.e. a user is on an official Google page, selects a user and is redirected to an attacker for the password prompt - halfway through the login flow, when a user has likely already established they are on a real site): http://www.tomanthony.co.uk/blog/google-login-hijack/

Sometimes open redirects are unavoidable, but all too often they aren't necessary and so it is simply lazy to not fix them and point to Google and others who mark them as WONTFIX as reason not to bother doing so yourself.

Re: Open redirects – a vulnerability class no one but attackers cares about

#28

Post by xxs »

tikumo wrote: post #25

You could just add some kind of hash based on the redirect url and check that, to ensure that it can't be altered.

For this you need some pepper (i.e. a secret) to prevent doctoring.

The better option is an encrypted blob containing all relevant data and a timing component. Of course those thing do require effort. It makes it opaque for everyone but the server handling the redirect.

Re: Open redirects – a vulnerability class no one but attackers cares about

#29

Post by Cyphase »

shittyadmin wrote: post #15
tptacek wrote: post #5

I don't know, I think this case is pretty flimsy. In practice, the value of an open redirect against modern applications is for "phishing". But speaking as someone who has dealt with several ATO dramas over the past two years: users will click on anything. They're not hovering over links to make sure they're safe. Open redirects are worth fixing, but they're a lot more common than I think people expect they are. I th…

That's quite true, but I think the value in these attacks is that they work against more technical users than typical phishing attacks - I remember several years ago someone posted a link on a large technical subreddit which appeared to be to youtube.com. It presented a page which claimed to be an age flagged video - at the time youtube was having many problems with age flagging videos - and sure enough many people t…

The results could have been skewed by people clicking through intentionally to experience the redirect.

Re: Open redirects – a vulnerability class no one but attackers cares about

#30

Post by chrismorgan »

userbinator wrote: post #4

Open redirects are also used to prevent referrers from propagating through. In that sense, they're very useful for anonymisation.

I really, really hate such things: they’re no longer at all necessary (see referrer-policy), and they clutter up browser history with an extraneous entry every time.
Post reply on HN