Serious security flaw in OAuth, OpenID discovered

[Chicog]

Not a risk to sensible users, but will no doubt do the rounds this week.

Following in the steps of the OpenSSL vulnerability Heartbleed, another major flaw has been found in popular open-source security software. This time, the holes have been found in the login tools OAuth and OpenID, used by many websites and tech titans including Google, Facebook, Microsoft, and LinkedIn, among others.

Wang Jing, a Ph.D student at the Nanyang Technological University in Singapore, discovered that the serious vulnerability "Covert Redirect" flaw can masquerade as a login popup based on an affected site's domain. Covert Redirect is based on a well-known exploit parameter.

For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that's similar to trick users, the Covert Redirect flaw uses the real site address for authentication.

If a user chooses to authorize the login, personal data (depending on what is being asked for) will be released to the attacker instead of to the legitimate website. This can range from email addresses, birth dates, contact lists and possibly even control of the account.

Regardless of whether the victim chooses to authorize the app, they will then get redirected to a website of the attacker's choice, which could potentially further compromise the victim.

http://www.cnet.com/news/serious-security-flaw-in-oauth-and-openid-discovered/

[Wacoal]

swear i notice this type of redirect happening for many years now on login from various places/devices/os in thailand