DoubleClick do Google pode ser vulnerável a ataques

DoubleClick do Google pode ser vulnerável a ataques

Segundo o pesquisador Wang Jing, um estudante de matemática , a partir de Nanyang Technological Univeristity , Singapura, do Tetraph blog, o DoubleClick – sistema de compra e venda de anúncios do Google – estaria suscetível a ataques do tipo spam e phishing. A descoberta deixa o Google e os utilizadores/usuários do DoubleClick em alerta.












Entenda a vulnerabilidade do DoubleClick

Em sua pesquisa, Wang Jing encontrou vulnerabilidades de Open Redirect, que permitiram que hackers redirecionassem usuários para um site malicioso, sem a necessidade de qualquer validação, ou seja, o usuário clicaria em um anúncio e ao invés de ser direcionado para o site da propaganda, seria redirecionado para um site infectado.
Jing afirmou ainda que a grande popularidade do DoubleClick faz com que os ataques a essas vulnerabilidades sejam mais comuns, em especial para spam e phishing.





http://www.techenet.com/2014/12/doubleclick-do-google-pode-ser-vulneravel-a-ataques/

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability
Product: PingFederate 6.10.1 SP Endpoints
Vendor: Ping Identity Corporation
Vulnerable Versions: 6.10.1
Tested Version: 6.10.1
Advisory Publication: Dec 09, 2014
Latest Update: Dec 09, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8489
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]





http://www.inzeed.com/kaleidoscope/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability/

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: WebPress

Vendor: goYWP

Vulnerable Versions: 13.00.06

Tested Version: 13.00.06

Advisory Publication: Dec 09, 2014

Latest Update: Dec 09, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8751

Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]

http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html

CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8754 WordPress “Ad-Manager Plugin” Dest Redirect Privilege Escalation Security Vulnerability

















Exploit Title: WordPress Ad-Manager Plugin Dest Redirect Privilege Escalation Security Vulnerability
Product: WordPress Ad-Manager Plugin
Vendor: CodeCanyon
Vulnerable Versions: 1.1.2
Tested Version: 1.1.2
Advisory Publication: Nov 25, 2014
Latest Update: Nov 25, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8754
CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 8.6
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]





http://seclists.org/fulldisclosure/2014/Nov/93

CVE-2014-7291 Springshare LibCal XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-7291  Springshare LibCal XSS (Cross-Site Scripting) Security Vulnerability

Exploit Title: Springshare LibCal Multiple XSS (Cross-Site Scripting) Vulnerability

Product: LibCal

Vendor: Springshare

Vulnerable Versions: 2.0

Tested Version: 2.0

Advisory Publication: Nov 25, 2014

Latest Update: Nov 25, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-7291

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

Solution Status: Fixed by Vendor

Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]

https://computertechhut.wordpress.com/2014/12/29/cve-2014-7291-springshare-libcal-xss-cross-site-scripting-security-vulnerability/

CVE-2014-7292 Newtelligence dasBlog Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-7292 Newtelligence dasBlog Dest Redirect Privilege Escalation Security Vulnerability

 

Exploit Title: Newtelligence dasBlog Dest Redirect Privilege Escalation Vulnerability
Product: dasBlog
Vendor:    Newtelligence
Vulnerable Versions: 2.3 (2.3.9074.18820) 2.2 (2.2.8279.16125) 2.1(2.1.8102.813)
Tested Version: 2.3 (2.3.9074.18820)
Advisory Publication: OCT 15, 2014
Latest Update:    OCT 15, 2014
Vulnerability Type: Open Redirect [CWE-601]
CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 8.6
Exploitability Subscore: 8.6
Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]

http://seclists.org/fulldisclosure/2014/Oct/91

Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability

Newtelligence DasBlog CVE-2014-7292 Open Redirection Vulnerability



Bugtraq ID:     70654
Class:     Input Validation Error
CVE:     CVE-2014-7292
Remote:     Yes
Local:     No
Published:     Oct 20 2014 12:00AM
Updated:     Oct 20 2014 12:00AM
Credit:     Wang Jing

http://www.securityfocus.com/bid/70654

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Security Vulnerability

CVE-2014-8489 Ping Identity Corporation “PingFederate 6.10.1 SP Endpoints” Open Redirect Web Security Vulnerability

Exploit Title: “Ping Identity Corporation” “PingFederate 6.10.1 SP Endpoints” Dest Redirect Privilege Escalation Web Security Vulnerability

Product: PingFederate 6.10.1 SP Endpoints

Vendor: Ping Identity Corporation

Vulnerable Versions: 6.10.1

Tested Version: 6.10.1

Advisory Publication: November 27, 2014

Latest Update: December 16, 2014

Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]

CVE Reference: CVE-2014-8489

mpact CVSS Severity (version 2.0):
CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification

Author and Writer: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

  

Introduction Details

(1) Vendor & Product Description:


Vendor:
Ping Identity


Product & Vulnerable Versions:
PingFederate 
6.10.1 


Vendor URL & Download:
PingFederate 6.10.1  can be gained from here,
http://documentation.pingidentity.com/display/PF66/Service+Provider+Integration



Product Introduction Overview:

"An SP is the consumer of identity attributes provided by the IdP through a SAML assertion. SP integration involves passing the identity attributes from PingFederate to the target SP application. The SP application uses this information to set a valid session or other security context for the user represented by the identity attributes. Session creation can involve a number of approaches, and as for the IdP, Ping Identity offers commercial integration kits that address the various SP scenarios. Most SP scenarios involve custom-application integration, server-agent integration, integration with an IdM product, or integration with a commercial application.

 Custom Applications: many applications use their own authentication mechanisms, typically through a database or LDAP repository, and are responsible for their own user-session management. Custom-application integration is necessary when there is limited or no access to the Web or application server hosting the application. Integration with these custom applications is handled through application-level integration kits, which allow software developers to integrate their applications with a PingFederate server acting as an SP.

With these integration kits, PingFederate sends the identity attributes from the SAML assertion to the SP application, which can then use them for its own authentication and session management. As for the IdP, application-specific integration kits include an SP agent, which resides with the SP application and provides a simple programming interface to extract the identity attributes sent from the PingFederate server. The information can be used to start a session for the SP application.

Ping Identity provides custom-application integration kits for a variety of programming environments, including: Java, .NET, PHP.

In addition, Ping Identity provides an Agentless Integration Kit, which allows developers to use direct HTTP calls to the PingFederate server to temporarily store and retrieve user attributes securely, eliminating the need for an agent interface."

(2) Vulnerability Details:

PingFederate 6.10.1 SP Endpoints web application has a computer security bug problem. It can be exploited by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

Other similar products 0day vulnerabilities have been found by some other bug hunter researchers before. PingFederate has patched some of them. Web Security Watch is an aggregator of security reports coming from various sources. It aims to provide a single point of tracking for all publicly disclosed security issues that matter. "Its unique tagging system enables you to see a relevant set of tags associated with each security alert for a quick overview of the affected products. What's more, you can now subscribe to an RSS feed containing the specific tags that you are interested in - you will then only receive alerts related to those tags." It has published suggestions, advisories, solutions details related to website vulnerabilities.

(2.1) The security programming code flaw occurs at  “&TargetResource” parameter in “/startSSO.ping?” page.

 

References:

http://tetraph.com/security/open-redirect/cve-2014-8489-ping-identity-open_redirect
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01416.html

http://lists.openwall.net/full-disclosure/2014/12/09/5
https://vulnerabilitypost.wordpress.com/2014/04/29/cve-2014-8489-ping-identity
http://computerobsess.blogspot.com/2014/12/cve-2014-8489-ping-identity-corporation.html
http://permalink.gmane.org/gmane.comp.security.fulldisclosure/1302
packetstormsecurity.com/files/130841/Innovative-WebPAC-Pro-2.0-Open-Redirect.html
http://marc.info/?l=full-disclosure&m=141815926328949&w=4

http://seclists.org/fulldisclosure/2014/Dec/35

http://itsecurity.lofter.com/post/1cfbf9e7_54fc5a7

http://whitehatview.tumblr.com/post/106597418411/ithut-cve-2014-8489-

http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Open-Redirect.html

https://itswift.wordpress.com/2014/12/30/cve-2014-8489-ping-identity-url_redirection

http://securityrelated.blogspot.com/2014/12/cve-2014-8489-ping-identity-corporation.html

http://www.osvdb.org/show/osvdb/115651

http://mathswift.blogspot.com/2014/12/cve-2014-8489-ping-identity-corporation.html

http://www.inzeed.com/kaleidoscope/computer-security/cve-2014-8489-ping-identity
http://diebiyi.com/articles/security/cve-2014-8489-ping-identity

CVE-2014-8751 goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

CVE-2014-8751  goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Exploit Title: goYWP WebPress Multiple XSS (Cross-Site Scripting) Security Vulnerabilities

Product: WebPress

Vendor: goYWP

Vulnerable Versions: 13.00.06

Tested Version: 13.00.06

Advisory Publication: Dec 09, 2014

Latest Update: Dec 09, 2014

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference: CVE-2014-8751

Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]

Advisory Details:

(1) Product

“WebPress is the foundation on which we build web sites. It’s our unique Content Management System (CMS), flexible enough for us to build your dream site, and easy enough for you to maintain it yourself.”

(2) Vulnerability Details:

goYWP WebPress has a security problem. It is vulnerable to XSS attacks.

(2.1) The first security vulnerability occurs at “/search.php” page with “&search_param” parameter in HTTP GET.

(2.2) The second security vulnerability occurs at “/forms.php” (form submission ) page with “&name”, “&address” “&comment” parameters in HTTP POST.

References:

http://seclists.org/fulldisclosure/2014/Dec/34

http://www.cnvd.org.cn/flaw/show/CNVD-2014-09095

http://cxsecurity.com/issue/WLB-2014120057

http://packetstormsecurity.com/files/129443/goYWP-WebPress-13.00.06-Cross-Site-Scripting.html

http://marc.info/?l=full-disclosure&m=141815910228867&w=4

http://tetraph.com/security/cves/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

http://www.scap.org.cn/CVE-2014-8751.html

http://advisories75.rssing.com/chan-6966477/all_p243.html#item4845

http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/xss-vulnerability/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

https://computertechhut.wordpress.com/2014/12/29/cve-2014-8751-goywp-webpress-multiple-xss-cross-site-scripting-security-vulnerabilities/

CVE-2014-7291 Springshare LibCal XSS (Cross-Site Scripting) Security Vulnerability

CVE-2014-7291  Springshare LibCal XSS (Cross-Site Scripting) Security Vulnerability Weakness



Exploit Title: Springshare LibCal Multiple XSS (Cross-Site Scripting) Security Weakness
Product: LibCal
Vendor: Springshare
Vulnerable Versions: 2.0
Tested Version: 2.0
Advisory Publication: Nov 25, 2014
Latest Update: Nov 25, 2014
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2014-7291
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
Solution Status: Fixed by Vendor
Credit: Wang Jing [SPMS, Nanyang Technological University (NTU), Singapore]







 
Recommendation Details:


(1) Vendor & Product Description:


Vendor:
Springshare


Product & Vulnerable Versions:
LibCal
2.0

Vendor URL & download:

http://springshare.com/libcal/


Product Introduction Overview:
“LibCal is an easy to use calendaring and event management platform for libraries. Used by 1,600+ libraries worldwide, LibCal makes it a breeze to manage online calendar of events, offer room bookings online, manage the opening hours for various locations."
    
    "Manage Calendar & Event Registrations
    Create custom Registration Forms
    Manage Consultation Appointments"
    Create an Online Room Booking System
    Display Library & Departmental Hours
    Share Calendar/Event Info via Widgets"


(2) Vulnerability Details:
Springshare LibCal web application has a security bug problem. It can be exploited by XSS attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several Springshare LibCal products vulnerabilities have been found by some other bug hunter researchers before. Springshare LibCal has patched some of them. The MITRE Corporation is a not-for-profit company that operates multiple federally funded research and development centers (FFRDCs), which provide innovative, practical solutions for some of our nation's most critical challenges in defense and intelligence, aviation, civil systems, homeland security, the judiciary, healthcare, and cybersecurity. It has published suggestions, advisories, solutions details related to Springshare LibCal vulnerabilities.


(2.1) The first code programming flaw  occur at “/api_events.php?” page, with “&m” and “&cid” parameters.




(3) Solutions:
2014-10-01: Report vulnerability to Vendor
2014-10-15: Vendor replied with thanks and vendor changed the source code







 

References:

https://cxsecurity.com/issue/WLB-2014120002

http://tetraph.com/security/cves/cve-2014-7291-springshare-libcal-xss-cross-site-scripting-vulnerability/

http://seclists.org/fulldisclosure/2014/Nov/90

http://packetstormsecurity.com/files/129289/Springshare-LibCal-2.0-Cross-Site-Scripting.html

http://www.securityfocus.com/bid/71319

http://www.scap.org.cn/CVE-2014-7291.html

http://whitehatpost.blog.163.com/blog/static/2422320542014112982712/#

http://www.cnnvd.org.cn/vulnerability/show/cv_id/2014110532

http://blog.livedoor.jp/dvw_j/archives/42129940.html

http://www.cnvd.org.cn/flaw/show/CNVD-2014-08568

http://marc.info/?l=full-disclosure&m=141705590727919&w=4

http://www.inzeed.com/kaleidoscope/cves/cve-2014-7291-springshare-libcal-xss-cross-site-scripting-security-vulnerability/

CVE-2014-7292 Newtelligence dasBlog Dest Redirect Privilege Escalation Security Vulnerability

Exploit Title: Newtelligence dasBlog Dest Redirect Privilege Escalation Vulnerability
Product: dasBlog
Vendor: Newtelligence
Vulnerable Versions: 2.3 (2.3.9074.18820) 2.2 (2.2.8279.16125) 2.1(2.1.8102.813)
Tested Version: 2.3 (2.3.9074.18820)
Advisory Publication: OCT 15, 2014
Latest Update: OCT 15, 2014
Vulnerability Type: Open Redirect [CWE-601]
CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 8.6
Exploitability Subscore: 8.6

Credit: Wang Jing [Mathematics, Nanyang Technological University (NTU), Singapore]




Advisory Details:



(1) Vendor URL:
https://searchcode.com/codesearch/view/8710666/ https://www.microsoft.com/web/gallery/dasblog.aspx



(2) Vulnerability Description:
“Newtelligence dasBlog ct.ashx is vulnerable to Open Redirect attacks.
dasBlog supports a feature called Click-Through which basically tracks all links clicked inside your blog posts. It’s a nice feature that allows the blogger to stay informed what kind of content readers like. If Click-Through is turned on, all URLs inside blog entries will be replaced with <URL to your blog>/ct.ashx?id=<Blog entry ID>&url=<URL-encoded original URL> which of course breaks WebSnapr previews.”


Web.config code:
<add verb=”*” path=”ct.ashx” type=”newtelligence.DasBlog.Web.Services.ClickThroughHandler, newtelligence.DasBlog.Web.Services”/>



(3) Vulnerability Detail:
Newtelligence dasBlog has a security problem. It is vulnerable to Open Redirect attacks.

(3.1) The vulnerability occurs at “ct.ashx?” page, with “&url” parameter,.






Solutions:
2014-10-15 Public disclosure with self-written patch.











References:

http://cxsecurity.com/issue/WLB-2014100118

http://www.tetraph.com/blog/cves/cve-2014-7292-newtelligence-dasblog-open-redirect-vulnerability/

http://www.securityfocus.com/bid/70654

http://seclists.org/fulldisclosure/2014/Oct/91

http://www.venustech.com.cn/NewsInfo/124/30608.Html

http://packetstormsecurity.com/files/128749/
http://computerobsess.blogspot.sg/2014/12/cve-2014-7292-newtelligence-dasblog.html

http://marc.info/?l=full-disclosure&m=141378771804426&w=4

http://www.cnvd.org.cn/flaw/show/CNVD-2014-07223
http://vulnerabilitypost.wordpress.com/2014/12/29/cve-2014-7292-newtelligence-dasblog-dest-redirect-privilege-escalation-security-vulnerability/  

Memory - iPod Old Screen - Shots Temperature Singapore Life

Memory - iPod Old Screen - Shots


Singapore Life - Temperature & Wallpaper 2011














More:
https://www.facebook.com/essaybeans/photos/a.500280613446743.1073741828.420695091405296/500271273447677/

Alvorlig feil i utbredt innloggingssystem

Alvorlig feil i utbredt innloggingssystem

Benyttes av Facebook, Google, Yahoo, LinkedIn, Microsoft og mange flere.

Wang Jing, en doktorgradstudent ved Nanyang Technological University i Singapore, har oppdaget en alvorlig sårbarhet knyttet til autentiseringssystemene OAuth 2.0 og OpenID. Sårbarheten, som er av typen «covert redirect», dreier seg om at en applikasjon tar en parameter og omdirigerer en bruker til parameteren uten tilstrekkelig validering. Ifølge Jing skyldes dette ofte at nettsteder har for stor tillit til sine partnere.

– Nettstedet sjekker domenenavnet mot et «token» (tildelt til partneren som et middel for verifisering) i den omdirigerte URL-en. Dersom paret er i godkjent-listen i nettstedets database, vil det tillate omdirigeringen. Men dersom URL-en tilhører et domene som har en «open redirect»-sårbarhet, kan brukerne omdirigeres fra nettstedet til et sårbart nettsted og deretter til en ondsinnet nettsted, skriver Jing.

http://www.digi.no/928515/alvorlig-feil-i-utbredt-innloggingssystem

एक अन्य Heartbleed?वेब सुरक्षा में पाया दोषों, Covert Redirect

एक अन्य Heartbleed?वेब सुरक्षा में पाया दोषों, Covert Redirect




इंटरनेट अब भी Heartbleed बग से जूझ रहा है, जबकि सुरक्षा प्रोटोकॉल OAuth 2.0 और OpenID में एक प्रमुख नए भेद्यता खोज की गई है.

सिंगापुर में नानयांग प्रौद्योगिकी विश्वविद्यालय की पीएचडी की छात्रा वांग जिंग हैकर्स उपयोगकर्ताओं को जानने के बिना प्रवेश जानकारी चोरी करने की कोशिश में फ़िशिंग तकनीक का उपयोग करने की अनुमति देता है कि एक बग देखा.


बग अनिवार्य रूप से साइबर अपराधी के बजाय डोमेन faking के अधिक आम रणनीति का एक फ़िशिंग पॉपअप सत्ता में असली वेबसाइट प्रमाणीकरण का उपयोग करने की अनुमति देता है.इस प्रक्रिया में, हैकर्स उपयोगकर्ता के लॉगिन क्रेडेंशियल प्राप्त होगा.




http://www.yac.mx/hi/pc-tech-tips/security/Another_Heartbleed_More_Flaws_Found_in_Web_Security.html

নতুন নিরাপত্তা ত্রুটি, হুমকির সম্মুখীন ফেসবুক গুগল ব্যবহারকারীরা

নতুন নিরাপত্তা ত্রুটি, হুমকির সম্মুখীন ফেসবুক গুগল ব্যবহারকারীরা

এবার নিরাপত্তা বিপর্যয় দেখা দিয়েছে বহুল ব্যবহৃত দুটি সিকিউরিটি স্ট্যান্ডার্ডে। যার মাধ্যমে যে কেউ গুগল, মাইক্রোসফট, ফেসবুক, টুইটারের মত অনলাইন সার্ভিস থেকে ব্যবহারকারীর অ্যাকাউন্ট ইনফরমেশনে একসেস পেতে সক্ষম হবে। এই বিপর্যয়ের নাম দেয়া হয়েছে "Covert Redirect"। যে সিকিউরিটি স্ট্যান্ডার্ডে এই ত্রুটি বিদ্যমান তা হলো ২ টি বহুল ব্যবহৃত ওপেন সোর্স সেশন অথোরাইজেশন প্রোটোকল OAuth 2.0 এবং OpenID।












আক্রমণকারীরা এই ত্রুটি কাজে লাগিয়ে যে কোন বৈধ ওয়েব সাইটে গোপনে ফিশিং এর চেষ্টা চালাতে সক্ষম, এই কথা জানিয়েছে ত্রুটি যিনি খুঁজে পেয়ে তিনি। সিঙ্গাপুরের নানইয়াং টেকনোলজিক্যাল ইউনিভার্সিটির পিএইচডি'র ছাত্র ওয়াং জিং এই নিরাপত্তা ত্রুটি খুঁজে পেয়েছেন।




http://www.onbangladesh.org/newsdetail/detail/200/75454

Heartbleed آخر؟أكثر عيوب وجدت في الأمن ويب, Covert Redirect

Heartbleed آخر؟أكثر عيوب وجدت في الأمن ويب, Covert Redirect






لقد تم اكتشاف ثغرة جديدة كبرى في البروتوكولات الأمنية أوث 2.0 وهوية OpenID في حين أن الإنترنت ما زالت تعاني من خلل Heartbleed.










طالب دكتوراه وانغ جينغ من جامعة نانيانغ التكنولوجية في سنغافورة رصدت الخلل الذي يسمح للقراصنة لاستخدام تقنيات التصيد في محاولة لسرقة تفاصيل الدخول دون معرفة المستخدمين.




علة يسمح أساسا مجرمي الإنترنت لاستخدام مصادقة الموقع الحقيقي لقوة التصيد المنبثقة، بدلا من تكتيك أكثر شيوعا من تزوير المجال.في هذه العملية، سوف تلقي المتسللين اعتماد تسجيل الدخول للمستخدم.





http://www.yac.mx/ar/pc-tech-tips/security/Another_Heartbleed_More_Flaws_Found_in_Web_Security.html

Covert Redirect - Knowledge

Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter and redirects a user to the parameter value without sufficient validation.

Covert Redirect is also related to single sign-on. It is well known by its influence on OAuth and OpenID. Covert Redirect was found and dubbed by a mathematics PhD student Wang Jing from School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore.



After Covert Redirect was published, it is kept in some common databases such as SCIP, OSVDB, Bugtraq, and X-Force. Its scipID is 13185, while OSVDB reference number is 106567. Bugtraq ID: 67196.  X-Force reference number is 93031.





Source:
http://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html

พบช่องโหว่ความปลอดภัยในระบบล็อกอิน OAuth และ OpenID เว็บใหญ่โดนกันถ้วนหน้า

พบช่องโหว่ความปลอดภัยในระบบล็อกอิน OAuth และ OpenID เว็บใหญ่โดนกันถ้วนหน้า





Wang Jing นักศึกษาปริญญาเอกจาก Nanyang Technology University ในสิงคโปร์ ประกาศค้นพบช่องโหว่ในระบบล็อกอิน OAuth 2.0 และ OpenID ที่ส่งผลกระทบต่อเว็บไซต์ชื่อดังเป็นจำนวนมาก









Jing เรียกช่องโหว่นี้ว่า "Covert Redirect" เพราะมันอาศัยการที่ระบบล็อกอินทั้งสองตัวจะยืนยันตัวตนผู้ใช้แล้ว redirect ไปยังเว็บไซต์ปลายทาง แต่กลับไม่ตรวจสอบเว็บไซต์ปลายทางให้ดีก่อน จึงอาจถูกใช้ในการปลอม redirect ไปยังเว็บไซต์ของผู้โจมตีแทนได้ (และเว็บไซต์ที่โจมตีจะได้ข้อมูลส่วนตัวจากเว็บไซต์ต้นทางไป แล้วแต่สิทธิที่ผู้ใช้อนุญาตให้)




https://www.blognone.com/node/55954

Xuất hiện lỗ hổng Covert Redirect, bản sao của "Trái tim rỉ máu"

Xuất hiện lỗ hổng Covert Redirect, bản sao của "Trái tim rỉ máu"

Một nghiên cứu sinh tại trường Đại học Công nghệ Nanyang (Singapore) vừa phát hiện một lỗ hổng bảo mật tồn tại trong phần mềm mã nguồn mở đang được rất nhiều website sử dụng. Thông tin mới nhất cho thấy lỗ hổng này ảnh hưởng đến cả Google, Facebook, Microsoft, LinkedIn, PayPal và một số công ty lớn khác.

Wang Jing, nghiên cứu sinh tiến sĩ tại Đại học Công nghệ Nanyang là người phát hiện ra lỗ hổng đang tồn tại trong công cụ đăng nhập mã nguồn mở OAuth và OpenID. Wang Jing gọi lỗ hổng này là "Covert Redirect" (tạm dịch là Bí mật chuyển hướng). Hacker có thể gài mã độc ẩn dưới dạng một cửa sổ pop-up, hiện ra khi người dùng đăng nhập vào một website có lỗ hổng. Chẳng hạn như khi người dùng gõ địa chỉ Facebook, một cửa sổ pop-up hiện ra yêu cầu điền tên đăng nhập và mật khẩu. Nếu người dùng đưa thông tin vào thì những thông tin ấy sẽ "bí mật chuyển hướng" đến hacker.

http://ictnews.vn/cntt/bao-mat/xuat-hien-lo-hong-covert-redirect-ban-sao-cua-trai-tim-ri-mau-116528.ict

Covert Redirect Mengancam OAuth 2.0 dan OpenID

Covert Redirect Mengancam OAuth 2.0 dan OpenID

Pada Jumat lalu, Wang Jing, seorang mahasiswa program PhD di Nanyang Technological University di Singapura, menerbitkan sebuah laporan yang memjabarkan tentang metode serangan yang disebut dengan “Covert Redirect” dan memperkenalkannya sebagai kerentanan atau vulnerable di OAuth 2.0 dan OpenID.

Cara kerja OAuth 2.0 dan OpenID sendiri adalah dengan memberikan akses bagi pengguna layanan ini untuk mendapatkan domain yang dapat mengakses menggunakan kredensial yang telah ada kepada website lain seperti Facebook, Google, Microsoft atau LinkedIn. Dengan akses yang didapatkan pengguna layanan ini dapat menghapus sebuah akun dan menggantinya dengan akun yang baru.


http://www.inzeed.com/kaleidoscope/computer-security/covert-redirect-mengancam-oauth-2-0-dan-openid/

Keep calm e fate attenzione: OpenID e OAuth sono vulnerabili

Keep calm e fate attenzione: OpenID e OAuth sono vulnerabili

Solo un paio di settimane dopo il preoccupante bug conosciuto come Heartbleed, un utente di Internet come me e voi ha scoperto una nuova e a quanto pare diffusa vulnerabilità, anche questa non facile da  risolvere. Si tratta del bug “Covert redirection”, scoperto di recente da Wang Jing, uno dottorando in matematica presso la Nanyang Technological University di Singapore. Il problema è stato riscontrato all’interno dei popolari protocolli Internet OpenID e OAuth. Il primo protocollo viene utilizzato quando si cerca di accedere a un sito web usando le credeziali già create per i servizi di Google, Facebook o LinkedIn. Il secondo viene utilizzato quando si autorizza un sito web, una app o alcuni servizi con Facebook, Google +, ecc… senza rivelare di fatto la password e le credenziali a siti esterni. Questi due metodi vengono spesso usati insieme e, a quanto pare, potrebbero permettere ai cybercriminali di mettere mano sulle informazioni degli utenti.

La minaccia

Su Threatpost sono disponibili maggiori informazioni tecniche sul bug e un link alla ricerca originale, in inglese. Ma andiamo la sodo e osserviamo come funziona un possibile attacco e quali sarebbero le sue conseguenze. In primo luogo, affinché si verifichi il problema, un utente dovrebbe visitare un sito di phishing dannoso dotato del tipico “Accedi con Facebook”. Il sito potrebbe assomigliare del tutto a un servizio popolare esterno, fingendosi e proponendosi come un nuovo servizio. Poi il vero Facebook, Google +  o LinkedIn lancia una popup che invita l’utente a inserire le credenziali di login e la password per autorizzare i servizi appena menzionati (e in teoria “rispettabili”) e permettere all’utente di accedere. Nell’ultima fase, l’autorizzazione a usare il profilo viene inviata a un sito diverso (di phishing), “redirezionando” le informazioni in forma impropria.




http://blog.kaspersky.it/facebook-openid-oauth-vulnerabili/3639/

XSS κίνδυνοι εντοπίστηκαν σε συνδέσμους στο New York Times σε άρθρα πριν το 2013

Οι διευθύνσεις URL σε άρθρα στους New York Times (NYT) που δημοσιεύτηκαν πριν από το 2013 έχουν βρεθεί να είναι ευάλωτες σε XSS (cross-site scripting) επίθεση, ικανή να μεταφέρει κώδικα που θα εκτελείται στο πρόγραμμα περιήγησης.

Ένας φοιτητής από τη Σιγκαπούρη με το όνομα Wang Jing ανέφερε την Πέμπτη την ευπάθεια XSS που επηρεάζει τους αναγνώστες της online εφημερίδας. Δημιούργησε επίσης ένα βίντεο που αποδεικνύει την επίθεση στις σελίδες διαφόρων παλαιών άρθρων στο NYT.


Μια ευπάθεια XSS πηγάζει από την επικύρωση ανεπαρκών εισροών χρήστη και επιτρέπει σε μια απειλή να χρησιμοποιήσει κακόβουλο κώδικα σε αυτούς που κάνουν κλικ στον σύνδεσμο. Βασικά, κακή JavaScript προστίθεται μετά από ένα διπλό απόσπασμα σε μια νόμιμη σύνδεση και στη συνέχεια εκτελέστηκαν.


Ο δυνητικός κίνδυνος είναι προφανής, δεδομένου ότι ο εισβολέας θα μπορούσε να επισκιάσει συνεδρίες του προγράμματος περιήγησης, να κλέψει τα cookies ή να κατευθύνει τον χρήστη σε ιστοσελίδες phishing.


Ο ερευνητής δήλωσε ότι δοκίμασε την επίθεση σε Firefox (26.0), σε Ubuntu (12.04) και IE (9.0.15), με Windows 7 και δεν απαιτείται σύνδεση του χρήστη, όπως μπορείτε να δείτε στο βίντεο επίδειξης παρακάτω.


http://youtu.be/RekCK5tjXWQ





πηγή :
http://www.inzeed.com/kaleidoscope/computer-security/xss-%CE%BA%CE%AF%CE%BD%CE

OAuthとOpenIDに深刻な脆弱性か--Facebookなど大手サイトに影響も

OAuthとOpenIDに深刻な脆弱性か--Facebookなど大手サイトに影響も



OpenSSLの脆弱性「Heartbleed」に続き、人気のオープンソースセキュリティソフトウェアでまた1つ大きな脆弱性が見つかった。今回、脆弱性が見つかったのはログインツールの「OAuth」と「OpenID」で、これらのツールは多数のウェブサイトと、Google、Facebook、Microsoft、LinkedInといったテクノロジ大手に使われている。









　 シンガポールにあるNanyang Technological University（南洋理工大学）で学ぶ博士課程の学生Wang Jing氏は、「Covert Redirect」という深刻な脆弱性によって、影響を受けるサイトのドメイン上でログイン用ポップアップ画面を偽装できることを発見した。Covert Redirectは、既知のエクスプロイトパラメータに基づいている。




　 たとえば、悪意あるフィッシングリンクをクリックすると、Facebook内でポップアップウィンドウが開き、アプリを許可するよう求められる。 Covert Redirect脆弱性の場合、本物に似た偽ドメイン名を使ってユーザーをだますのではなく、本物のサイトアドレスを使って許可を求める。




http://www.asahi.com/tech_science/cnet/CCNET35047497.html