Serious hard-to-fix bug in OAuth and OpenID discovered, lots of major sites affected
Just a short notice rather than a real article, full story later (I need to check the facts): Several sources are posting about a recently discovered hard-to-fix bug in the extremely popular open-source authentication libraries/services OAuth and OpenID, used by lots of AAA-level sites, from PayPal to Facebook.
Articles:
cnet – Serious security flaw in OAuth, OpenID discovered
lifehacker – Security Flaw Found in OAuth and OpenID, Here’s What It Means for You
(german) zdnet – Schwere Sicherheitslücke in OAuth und OpenID entdeckt
Huge info-page by Wang Jing, the guy who has discovered the bug:
http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html
YouTube channel (of Wang Jing), showing reproduceable examples (on Facebook, LinkedIn and Google):
https://www.youtube.com/user/tetraph
Info video:
https://www.youtube.com/watch?v=HUE8VbbwUms
Reproduceable examples (taken from the above YouTube channel)
https://www.youtube.com/watch?v=iif6eq2cvso
https://www.youtube.com/watch?v=Y2-2Scp0pbs
https://www.youtube.com/watch?v=GyNGBuHNoJ0
Random articles
A PHPStorm shortcuts cheat sheet (for Windows, Mac OS and Linux)
PHPMyAdmin not found after installation ? Here’s a fix (Ubuntu 12.04) !
You made a mess with Git ? Here’s a flowchart guideline on how to fix
Tim Sweeney talks about the future of game graphics (and which hardware we need to “clone” reality)
How to show memory usage (Ubuntu)
Creator of Slim framework and “PHP – The right way” writes book: “Modern PHP”, available 2015
A super-simple pre-configured Vagrant box with HipHop, Hack and Hack code examples
How the PHP session garbage collector really works- How to install/setup latest version of PHPMyAdmin on Ubuntu 12.04 LTS (Precise Pangolin)
I wouldn’t quite consider it a security issue or a bug. The standards OAuth puts in place performs a request based on a signature prepared by the application generating the URL. Any access being granted is to the application initially signing the request.
It is indeed a phishing risk, and potentially a design flaw in the spec of the oauth standard. But it’s a simple fix. Add the redirect url to the hmac signature and if the request uri doesn’t match the redirect parameter then bail with a message notifying the user that the signature could not be verified.
Thanks, good info in here! Btw I’ve written this before reading into the topic. Most good sources also say it’s not a bug, it’s simply bad implementation of the according companies / developers.