绿意蛙鸣

毕竟西湖六月中,风光不与四时同。
接天莲叶无穷碧,映日荷花别样红。

The New York Times(Nytimes.com) Covert Redirect We

来自:tetraph


The New York Times(Nytimes.com) Covert Redirect Web Security Bug Based on Google Doubleclick.net - tetraph - Tetraph  的博客

  

(1) WebSite:
nytimes.com



"The New York Times (NYT) is an American daily newspaper, founded and continuously published in New York City since September 18, 1851, by the New York Times Company. It has won 117 Pulitzer Prizes, more than any other news organization.

 

The paper's print version has the largest circulation of any metropolitan newspaper in the United States, and the second-largest circulation overall, behind The Wall Street Journal. It is ranked 39th in the world by circulation. Following industry trends, its weekday circulation has fallen to fewer than one million daily since 1990. Nicknamed for years as "The Gray Lady", The New York Times is long regarded within the industry as a national "newspaper of record". It is owned by The New York Times Company. Arthur Ochs Sulzberger, Jr., (whose family (Ochs-Sulzberger) has controlled the paper for five generations, since 1896), is both the paper's publisher and the company's chairman. Its international version, formerly the International Herald Tribune, is now called the International New York Times." (Wikipedia)

 

 

 

 

(2) Vulnerability Description:

The New York Times web application has a computer cyber security problem. Hacker can exploit it by Covert Redirect attacks. 



The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04),Apple Safari 6.1.6 of Mac OS X Lion 10.7. 

 

 

 

The programming code flaw occurs at “adx_click.html?” page with “&goto” parameter, i.e.

http://www.nytimes.com/adx/bin/adx_click.html?type=goto&opzn&page=www.nytimes.com/pages/nyregion/index.html&pos=SFMiddle&sn2=8dfce1f6/9926f9b3&sn1=bbba504f/c0de9221&camp=CouplesResorts_1918341&ad=NYRegionSF_Feb_300x250-B5732328.10663001&goto=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fddm%2Fclk%2F279541164%3B106630011%3Bs%3Fhttp%3A%2F%2Ffacebook%2Ecom%2Fall%2Dinclusive%2Ephp%3Futm%5Fsource%3Dnyt%26utm%5Fmedium%3Ddisplay%26utm%5Fcontent%3Dclicktracker%26utm%5Fcampaign%3D300x250%5FExpectMore%5FNYT%5FNYRegion

 

 

 

 

 

(2.1) When a user is redirected from Nytimes to another site, Nytimes will check parameters “&sn1″ and “&sn2″. If the redirected URL’s domain is OK, Nytimes will allow the reidrection.

 

However, if the URLs in a redirected domain have open URL redirection vulnerabilities themselves, a user could be redirected from Nytimes to a vulnerable URL in that domain first and later be redirected from this vulnerable site to a malicious site. This is as if being redirected from Nytimes directly.

 

 

One of the vulnerable domain is,
doubleclick.net (Google’s Ad website)

 

 

 

 

(2.2) Use one of webpages for the following tests. The webpage address is “http://xingti.tumblr.com”. We can suppose that this webpage is malicious.

 

 

Vulnerable URL:
http://www.nytimes.com/adx/bin/adx_click.html?type=goto&opzn&page=www.nytimes.com/pages/nyregion/index.html&pos=SFMiddle&sn2=8dfce1f6/9926f9b3&sn1=bbba504f/c0de9221&camp=CouplesResorts_1918341&ad=NYRegionSF_Feb_300x250-B5732328.10663001&goto=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fddm%2Fclk%2F279541164%3B106630011%3Bs%3Fhttp%3A%2F%2Ffacebook%2Ecom%2Fall%2Dinclusive%2Ephp%3Futm%5Fsource%3Dnyt%26utm%5Fmedium%3Ddisplay%26utm%5Fcontent%3Dclicktracker%26utm%5Fcampaign%3D300x250%5FExpectMore%5FNYT%5FNYRegion

 

 

 

POC:
http://www.nytimes.com/adx/bin/adx_click.html?type=goto&opzn&page=www.nytimes.com/pages/nyregion/index.html&pos=SFMiddle&sn2=8dfce1f6/9926f9b3&sn1=bbba504f/c0de9221&camp=CouplesResorts_1918341&ad=NYRegionSF_Feb_300x250-B5732328.10663001&goto=http%3A%2F%2Fad%2Edoubleclick%2Enet%2Fddm%2Fclk%2F279541164%3B106630011%3Bs%3Fhttp%3A%2F%2Ftetraph%2Ecom%2Fblog%3F%2Dinclusive%2Ephp%3Futm%5Fsource%3Dnyt%26utm%5Fmedium%3Ddisplay%26utm%5Fcontent%3Dclicktracker%26utm%5Fcampaign%3D300x250%5FExpectMore%5FNYT%5FNYRegion

 

 

 

 

POC Video:
https://www.youtube.com/watch?v=3XtrUqzxNW0

 


Blog Detail:
http://tetraph.blogspot.com/2014/05/nytimes-covert-redirect-vulnerability.html



 

 

 

(3) What is Covert Redirect? 

Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter and redirects a user to the parameter value without sufficient validation. This often makes use of Open Redirect and XSS vulnerabilities in third-party applications.

 

 

Covert Redirect is also related to single sign-on. It is known by its influence on OAuth and OpenID. Hacker may use it to steal users' sensitive information. Almost all OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect was found and dubbed by a Mathematics PhD student Wang Jing from School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore.



After Covert Redirect was published, it is kept in some common databases such as SCIP, OSVDB, Bugtraq, and X-Force. Its scipID is 13185, while OSVDB reference number is 106567. Bugtraq ID: 67196.  X-Force reference number is 93031.

 

 

 

 

 

 

 

 

 

Discover and Reporter:
Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)
http://www.tetraph.com/wangjing

 

 

 

 

 

 

More Articles:
http://tetraph.com/security/covert-redirect/nytimes-covert-redirect-vulnerability-based-on-google-doubleclick/
http://computerobsess.blogspot.com/2014/11/nytimes-covert-redirect-vulnerability.html
http://whitehatview.tumblr.com/post/102682917011/the-new-york-times-nytimes
https://mathfas.wordpress.com/2014/11/15/the-new-york-timesnytimes-com
http://tetraph.blog.163.com/blog/static/234603051201444111911779/
http://aga.ustc.edu.cn/news/view?id=2094http://webtech.lofter.com/post/1cd3e0d3_706aec6
http://www.inzeed.com/kaleidoscope/covert-redirect/nytimes-covert-redirect-vulnerability-based-on-google-doubleclick/
http://webcabinet.tumblr.com/post/118901188782/itinfotech-covert#notes
https://twitter.com/tetraphibious/status/559167627470180352
http://xingti.tumblr.com/post/121909911895/the-new-york-times-nytimes-com-covert-redirect
http://securityrelated.blogspot.com/2014/11/the-new-york-timesnytimes.html
https://tetraph.wordpress.com/2014/11/15/the-new-york-timesnytimes-com-covert-redirect

 

 

 

 

评论