Comments on: Possible OpenID exploit? http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/ Sun, 12 Oct 2008 05:17:23 +0000 http://wordpress.org/?v=2.6.2 By: alistair_uk http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-58 alistair_uk Wed, 28 Mar 2007 18:44:39 +0000 http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-58 This will not actually work unless you can redirect both the client and web server machines to the malicious OpenID server. If memory serve me corectly OpenID can function in two ways. 1) The best is when the web server contacts the OpenID server and that agree on a secret to encrypt there communication by. Although the communication is via the client without the secret (that only the web server and OpenID server knows) you can not get the evil OpenID server to pretend to be the good one. 2) The other solution is where the details are passed between the OpenID and web servers via the client unencrypted. When this happens the web server should ask the OpenID server directly if what it received from the client is true. You might have noticed that in both these scenarios the web server contacts the OpenID server in a way that bypasses the client completely so the server can not be spoofed. ...so in summary it is not actually problem at all, provided the person implementing the web site does not take any stupid short cuts and miss out part of the communication to save some coding time. With library available for most platforms there really is not need to take these shortcuts. This will not actually work unless you can redirect both the client and web server machines to the malicious OpenID server.

If memory serve me corectly OpenID can function in two ways.

1) The best is when the web server contacts the OpenID server and that agree on a secret to encrypt there communication by. Although the communication is via the client without the secret (that only the web server and OpenID server knows) you can not get the evil OpenID server to pretend to be the good one.

2) The other solution is where the details are passed between the OpenID and web servers via the client unencrypted. When this happens the web server should ask the OpenID server directly if what it received from the client is true.

You might have noticed that in both these scenarios the web server contacts the OpenID server in a way that bypasses the client completely so the server can not be spoofed.

…so in summary it is not actually problem at all, provided the person implementing the web site does not take any stupid short cuts and miss out part of the communication to save some coding time. With library available for most platforms there really is not need to take these shortcuts.

]]> By: Cristiano Gerard Betta http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-57 Cristiano Gerard Betta Tue, 27 Mar 2007 01:23:12 +0000 http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-57 Ok, I gave my theory a quick run by making a fake entry that routes alper.nl to localhost. Somehow though I never see the browser linking to that page but directly to Alper's true provider http://myopenid.com. I suspect that the OpenID protocol get's this first step at the server side. After this I tried to make a fake entry to the myopenid site, but that didn't really help because another redirect is not possible. The solution I think is to run a "free" server that gives a valid response anytime, and then link the dns entry in the hosts file for myopenid to that server. This is more work and will have to try that later. Ok, I gave my theory a quick run by making a fake entry that routes alper.nl to localhost. Somehow though I never see the browser linking to that page but directly to Alper’s true provider http://myopenid.com. I suspect that the OpenID protocol get’s this first step at the server side.

After this I tried to make a fake entry to the myopenid site, but that didn’t really help because another redirect is not possible. The solution I think is to run a “free” server that gives a valid response anytime, and then link the dns entry in the hosts file for myopenid to that server.

This is more work and will have to try that later.

]]> By: Cristiano Gerard Betta http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-56 Cristiano Gerard Betta Tue, 27 Mar 2007 00:39:12 +0000 http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-56 I think I will try it in a couple of weeks. Wednesday I leave for the Netherlands, so I have to try it either tommorow or when I get back. I think I will try it in a couple of weeks. Wednesday I leave for the Netherlands, so I have to try it either tommorow or when I get back.

]]> By: Dan W http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-55 Dan W Mon, 26 Mar 2007 19:10:06 +0000 http://blog.cristianobetta.com/2007/03/26/possible-openid-exploit/#comment-55 If you can't find an answer give the exploit a try to see If you can’t find an answer give the exploit a try to see

]]>