Logo
  • PHP
    • HipHop / HHVM
    • Modern PHP
    • PHPStorm
    • LAMP
    • Laravel
    • Composer
    • PDO
  • JavaScript
    • node.js
    • AngularJS
  • CSS
    • SASS
    • “CSS4” (CSS level 4)
  • HTML
  • Git
  • LAMP
  • Vagrant
  • UI / UX
  • Architecture of …
  • Off-Topic
With ♥ from Berlin
May 3, 2014
Chris
Login, Security
2

Serious hard-to-fix bug in OAuth and OpenID discovered, lots of major sites affected

PreviousNext

Just a short notice rather than a real article, full story later (I need to check the facts): Several sources are posting about a recently discovered hard-to-fix bug in the extremely popular open-source authentication libraries/services OAuth and OpenID, used by lots of AAA-level sites, from PayPal to Facebook.

 

Articles:
cnet – Serious security flaw in OAuth, OpenID discovered
lifehacker – Security Flaw Found in OAuth and OpenID, Here’s What It Means for You

(german) zdnet – Schwere Sicherheitslücke in OAuth und OpenID entdeckt


Huge info-page by Wang Jing, the guy who has discovered the bug:

http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html


YouTube channel (of Wang Jing), showing reproduceable examples (on Facebook, LinkedIn and Google):

https://www.youtube.com/user/tetraph


Info video:

https://www.youtube.com/watch?v=HUE8VbbwUms


Reproduceable examples (taken from the above YouTube channel)

https://www.youtube.com/watch?v=iif6eq2cvso

https://www.youtube.com/watch?v=Y2-2Scp0pbs

https://www.youtube.com/watch?v=GyNGBuHNoJ0

 

This article was written quite a while ago (9 years), please keep this in mind when using the information written here. Links, code and commands might be outdated or broken.

Random articles

  • PHP 5.7 gets refactored core, is 10%-30% faster than PHP 5.5! Wow!PHP 5.7 gets refactored core, is 10%-30% faster than PHP 5.5! Wow!
  • MINI, an extremely simple barebone PHP applicationMINI, an extremely simple barebone PHP application
  • Extremely simple deployment with PHPloyExtremely simple deployment with PHPloy
  • GitHub finally introduces repo traffic statsGitHub finally introduces repo traffic stats
  • October CMS, built on top of Laravel, is beautiful, clever and on the way to be the new #1 CMSOctober CMS, built on top of Laravel, is beautiful, clever and on the way to be the new #1 CMS
  • Redesigning Windows 8 – fantastic and clever drafts by Jay MachalaniRedesigning Windows 8 – fantastic and clever drafts by Jay Machalani
  • [Link] Retinafy your Site / Device by Nijiko Yonskai[Link] Retinafy your Site / Device by Nijiko Yonskai
  • How to setup a local server (in a virtual machine) with Vagrant in PHPStormHow to setup a local server (in a virtual machine) with Vagrant in PHPStorm
  • What’s new in PHPStorm 9What’s new in PHPStorm 9
Share this

2 Comments

  • slbmeh
    May 9, 2014 6:43 am

    I wouldn’t quite consider it a security issue or a bug. The standards OAuth puts in place performs a request based on a signature prepared by the application generating the URL. Any access being granted is to the application initially signing the request.

    It is indeed a phishing risk, and potentially a design flaw in the spec of the oauth standard. But it’s a simple fix. Add the redirect url to the hmac signature and if the request uri doesn’t match the redirect parameter then bail with a message notifying the user that the signature could not be verified.

    Reply
    • Chris
      May 9, 2014 11:47 am

      Thanks, good info in here! Btw I’ve written this before reading into the topic. Most good sources also say it’s not a bug, it’s simply bad implementation of the according companies / developers.

      Reply

Leave A Comment Cancel reply

vagrant

Generate Vagrant boxes with Laravel, HipHop, Nginx, WordPress, MySQL, MariaDB, MongoDB, RabbitMQ etc. with one click

Excellent new web tool: Protobox allows extremely easy setup of Vagrant boxes using a wonderful web UI. Beside the standard

phpstorm 7.0 php

How to install GitHub’s, NetBeans’s and Sublime2’s syntax highlighting code colours theme in PHPStorm 6/7

PHPStorm’s default code colouring might not be what you want, especially when you just switched from NetBeans. But there are

How to show memory usage (Ubuntu)

Always very useful: A simple command to show memory usage (Ubuntu / linux distros). cat /proc/meminfo   This article was

phpstorm-8

When PHPStorm’s cache eats up your harddisk space

I recently stumbled over this: By default PHPStorm (obviously in all versions since 1.0) creates a local history of all

JavaScript ECMAScript6 – A short video introduction (5min)

Excellent introduction into the new ECMAScript6, the spec behind JavaScript. This article was written quite a while ago (8 years),

php

PHP 5.7 gets refactored core, is 10%-30% faster than PHP 5.5! Wow!

What an announcement! The awesome PHP core guys have refactored the Zend Engine (which drives PHP) and could successfully speed

Support FLARUM, the future of PHP forum scripts (with some dollars on Kickstarter)

PHP forum scripts are horrible, let’s face it. Nearly everything that’s available is hard to install, hard to handle, hard

php

PHP 5.6 announced, statically typed (!) “new” PHP announced by Facebook devs

PHP 5.6 goes alpha PHP 5.6 has been announced for a while now, and these days things get serious (code-freeze,

phpstorm 7.0 php

PHPStorm 7 has been released!

DEV METAL does not get any money for saying this and there is no affiliate link or similar. This post

js javascript

Push database changes to all clients in real-time (!) with AngularJS and Firebase

The coolest talk I’ve seen this week: Anant Narayanan of Firebase shows how to build a simple but really impressive

1/4

Categories

Search

DigitalOcean coupon voucher 50
Only today: $50 coupon for DigitalOcean SSD VPS / hosting
sass laravel
Extremely easy SASS in Laravel (with pure PHP)
Hacking ATMs – A conference talk about the current security state of Windows XP driven cash machines
Adobe releases Firebug-like developer tools to edit and extract PSDs
A quick history of Comic Sans, the most wrongly used font ever
JavaScript ECMAScript6 – A short video introduction (5min)
How to hack time (KUNG FURY promo campaign)
phpstorm 7.0 php
How to install GitHub’s, NetBeans’s and Sublime2’s syntax highlighting code colours theme in PHPStorm 6/7
[Link] Making a website vertically responsive
php ide
Sitepoint asks for your favourite PHP IDE – take part!
Serious hard-to-fix bug in OAuth and OpenID discovered, lots of major sites affected
Quick fix for 404 error in WordPress category / tag page
php
PHP 5.6.0 RC1 is available
mod-rewrite-ubuntu-14-04-lts
Which server OS version to choose ? Some EOL lists of Debian, Ubuntu and CentOS
How Snapchat wants to earn money (by establishing vertical videos)

Tags

apache bash centos composer conference coupon CSS debian fonts framework git GitHub hack HHVM HipHop HTML HTML5 IDE JavaScript JS LAMP laravel linux mod_rewrite MVC MySQL Nginx optimization PHP PHP 5.5 PHP 5.6 phpmyadmin PHPStorm security server SSD Ubuntu UI UX vagrant video virtual machine voucher VPS wordpress
Side-Project: Wordle-Solver:
www.wordle-helper.info

Pages

  • Privacy Policy
 
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
Do not sell my personal information.
Cookie SettingsAccept
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checkbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT