By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    What is a Keylogger -Kaspersky Daily
    12 months ago
    An Interactive Map of Online Threats
    12 months ago
    KIS for Android: Secret Code vs. PIN
    12 months ago
    Latest News
    Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
    5 days ago
    Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
    6 days ago
    Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
    7 days ago
    Agent Tesla’s Unique Approach: VBS and Steganography for Delivery and Intrusion
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Critical vulnerability fixed in popular WordPress plugin Jetpack
    Critical vulnerability fixed in popular WordPress plugin Jetpack
    12 months ago
    Windows 10 22H2 new features and changes
    12 months ago
    Windows 11 build 22000.652 (KB5012643) out as preview
    12 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    7 months ago
    Now you can speed up any video in your browser
    7 months ago
    How to restore access to a file after EFS or view it on another computer?
    8 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    8 months ago
  • How To
    How ToShow More
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    18 hours ago
    Cloudflare account permissions, how to use them, and best practices
    Cloudflare account permissions, how to use them, and best practices
    18 hours ago
    Announcing Cloudflare Incident Alerts
    Announcing Cloudflare Incident Alerts
    18 hours ago
    Welcome to Birthday Week 2023
    Welcome to Birthday Week 2023
    2 days ago
    A new wave of innovation with Edge, your AI-powered browser
    3 days ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    How to make iPhone a listening device?
    11 months ago
    How to mirror Android screen on PC?
    11 months ago
    On Instagram, you can view stories and posts of closed accounts
    11 months ago
    Latest News
    How to use image layers on Paint for Windows 11
    6 days ago
    How to disable Copilot on Windows 11 (completely)
    2 weeks ago
    How to blur image background in Photos for Windows 11
    2 weeks ago
    How to hide text from screenshots on Snipping Tool for Windows 11
    2 weeks ago
  • Glossary
  • My Bookmarks
Reading: How to Deal with Vulnerable Facebook and Google OpenID Logins
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
Wordpress Threats

How to Deal with Vulnerable Facebook and Google OpenID Logins

Vitus White
Last updated: 13 October
Vitus White 12 months ago
Share
6 Min Read

Just a few weeks after the disturbing Heartbleed bug discovery, an ordinary Internet citizen like you and me may need to be concerned with another seemingly widespread issue, and it has no easy fix. It is the exact definition of a “Covert redirection” bug, recently publicized by Wang Jing, a PhD student in mathematics at the Nanyang Technological University in Singapore. The issues were found inside popular Internet protocols OpenID and Oauth; the former is utilized when you log in to web sites using your existing login from Google, Facebook, LinkedIN, etc., and the latter comes into play when you authorize sites, apps or services with Facebook/G+/etc., without actually revealing your password and login to third-party sites. These two are typically used in conjunction, and as it turns out, may lead your information into the wrong hands.

Contents
The threatIs it fixed? Not reallyYour action plan

The threat

Our friends at Threatpost have a more technical explanation of the issue, along with a link to the original research, but we’ll skip unnecessary details and just describe the possible attack scenario and consequences. First, a user visits a malicious phishing site, which has those typical “Login with Facebook” buttons. A phishing site may closely resemble one of the popular 3rd-party services or disguise itself as an entirely new service. Once you click on the button, a real Facebook/G+/LI popup will appear, prompting the user to enter their login and password information to authorize the aforementioned (and probably reputable) service to access their user profile. Finally, the authorization to use the profile is sent to the wrong (phishing) site using improper redirection.

First, a user visits a phishing site and tries to login with Facebook or other OpenID providers.

At the end of the day, a cybercriminal receives a proper authorization (OAuth token) to access the victim’s profile with whatever permissions the original application has ― in the best case, it’s just an access to basic user details; in the worst-case scenario, it is the ability to read contacts, send messages, etc.

Is it fixed? Not really

This threat probably won’t go away anytime soon, as the fix must be performed both on the provider side (Facebook/LinkedIn/Google, etc) and client side (third-party app or service). The OAuth protocol is still in beta, and various providers use different implementations, which vary in their ability to counteract the aforementioned attack scenario. LinkedIn was better positioned to implement the fix and took a more strict direction of handling things by requiring every third-party developer to provide a list of proper redirects. As of now, every app using LinkedIn authorization is either safe or nonfunctional. Things are different at Facebook, which is unhappy to have both a much wider set of third-party apps and maybe older OAuth implementation. That’s why Facebook reps told Jing that it “isn’t something that can be accomplished in the short term.”

There are many other providers, which seem to be vulnerable (check the picture below), so if you log in to some sites using these services, you must take action.

Vulnerable-providers

Your action plan

For the most cautious ones, the bulletproof solution would be giving up using OpenID and those handy “Login with…” buttons for a few months. You may also benefit from increased privacy, as using those logins from social networks enables much more efficient tracking of your online behavior and allows more and more sites to read your basic demographic data. To avoid the hurdle with memorizing tens or even hundreds of different logins for various sites, you may finally start using an efficient password manager. Most services today are equipped with multi-platform clients and cloud sync to ensure you have access to your passwords on every device you own.

For cautious users, the best solution would be giving up using Facebook/Google login for a few months. #OpenID #CovertRedirect

Tweet

However, if you plan to continue using OpenID authorization, there is no immediate danger in doing so. You just have to be very vigilant and avoid any phishing scams which typically start with some disturbing letter in your inbox or a provocative link on Facebook or other social network. If you log in to some service using Facebook/Google/etc., make sure you open the site of this service using a manually typed address or a bookmark, not the link from your emails or messengers. Double check the address bar to avoid visiting sketchy sites, and don’t sign up for new services with OpenID, unless you are 100% sure that the service is reputable and you’ve landed on the proper web site. In addition, use a safe browsing solution like Kaspersky Internet Security ― Multi-Device, which prevents your browser from visiting dangerous places, including phishing sites.

This is just an ordinary exercise in caution, which every Internet user should perform on a daily basis. Phishing threats are widespread and effective, leading to every kind of digital property loss, including: credit cards numbers, email logins and so on. The “Covert redirect” bug in OpenID and OAuth is just one more reason to do it―no exceptions allowed.


Source: kaspersky.com

Translate this article

TAGGED: DoS, Facebook, Google Play, Phishing, PoC, SASE, Security, Threat, Threats, Transport Layer Security
Vitus White October 13, 2022 October 7, 2022
Share This Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps 18 hours ago
Cloudflare account permissions, how to use them, and best practices
Cloudflare account permissions, how to use them, and best practices
Apps 18 hours ago
Announcing Cloudflare Incident Alerts
Announcing Cloudflare Incident Alerts
Apps 18 hours ago
Welcome to Birthday Week 2023
Welcome to Birthday Week 2023
Apps 2 days ago
A new wave of innovation with Edge, your AI-powered browser
Windows 3 days ago

You Might Also Like

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)

18 hours ago
Cloudflare account permissions, how to use them, and best practices
Apps

Cloudflare account permissions, how to use them, and best practices

18 hours ago
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Apps

Cloudflare Email Security now works with CrowdStrike Falcon LogScale

5 days ago
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Wordpress Threats

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)

5 days ago
Show More

Related stories

How to upgrade to Windows 11 23H2 with Installation Assistant
Critical Vulnerability in Forminator Plugin
How to blur image background in Photos for Windows 11
How to download official Windows 11 23H2 ISO file
PHP Object Injection Vulnerability in Flatsome Theme
How to download Windows 11 22H2 ISO after 23H2 releases
Previous Next

10 New Stories

Curator can help you with PC Game Pass picks
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
How to use image layers on Paint for Windows 11
New! Rate Limiting analytics and throttling
Previous Next
Hot News
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Cloudflare account permissions, how to use them, and best practices
Announcing Cloudflare Incident Alerts
Welcome to Birthday Week 2023
A new wave of innovation with Edge, your AI-powered browser
10alert.com10alert.com
Follow US
© 10 Alert Network. All Rights Reserved.
  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?