full-disclosure - Re: Facebook URL Redirect Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 2 Mar 2011 14:59:18 -0500
From: Nathan Power <np@...uritypentest.com>
To: Andrew Farmer <andfarm@...il.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Facebook URL Redirect Vulnerability

I understand what your saying but I don't agree.  We may have to agree to
disagree on this.

You can obscure a URL several different ways.  For this particular case, I
used decimal to IP.

In the following example, you can see the target URL isn't in a human
readable format.
http://apps.facebook.com/truthsaboutu/track.php?r=http%3A%2F%2F1208929384

Also when you post a link on Facebook,  'apps.facebook.com' is the only text
displayed to the user.

Nathan Power
www.securitypentest.com

On Wed, Mar 2, 2011 at 2:38 PM, Andrew Farmer <andfarm@...il.com> wrote:

> On 2011-03-02, at 06:30, Nathan Power wrote:
> > There are 3 different steps to perform an attack using a URL redirect:
>  1)
> > trick the user 2) redirect 3) exploit .. We are using a Facebook URL to
> > trick the user, we are using the URL redirect as the catalyst to perform
> an
> > exploit.
> >
> > Here are some examples of the types of attacks you can perform with a URL
> > redirect, CSRF, phishing (fake fb login), and browser exploits
> (javascript
> > zombie,0days,etc).
> >
> > How would you have written the impact section?
>
> Something like this:
>
> > 3. Impact:
> >
> > An attacker may obfuscate the target of a link, potentiating phishing
> attacks and/or bypassing some simple URL filters.
>
> Or something of the sort. The actual target of the link isn't obscured in
> the URL, so it's not even particularly convincing if the URL is displayed in
> plain text.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/