Menu
Mozilla unmasks security flaw in Persona, warns other OpenID implementers

Mozilla unmasks security flaw in Persona, warns other OpenID implementers

OpenID-related vulnerability could have allowed attackers to impersonate users on websites using Mozilla Persona authentication

A vulnerability found recently in an OpenID-based feature of the Mozilla Persona online identity management service prompted the company to advise Web developers to check their OpenID implementations for similar issues.

Mozilla Persona allows users to verify their ownership of one or more email addresses and then use those addresses to authenticate on websites. Users have to remember only their Persona account password, because once they're logged into the service, authenticating on Persona-enabled websites only takes two mouse clicks.

To verify email addresses for use with Persona users typically have to click on a link sent to those addresses, except for Gmail and Yahoo addresses which are verified through what Mozilla calls "Identity Bridging," a feature based on the OpenID authentication protocol.

It's in this identity bridge feature that three security researchers from the University of Trier in Germany have recently found a serious vulnerability. The flaw, which was reported through the Mozilla bug bounty program and is now fixed, could have allowed an attacker to authenticate on Persona-enabled websites with the Gmail or Yahoo Mail addresses of other users.

The vulnerability had no bearing on the security of Gmail or Yahoo Mail accounts and only impacted the Persona service and websites that allow authentication based on it, Michael Coates, Mozilla's director of security assurance, said Wednesday in a blog post.

The initial patches were deployed last Friday and some additional ones on Tuesday of this week, he said.

The problem stemmed from incorrect security and behavior assumptions with two third-party OpenID libraries, meaning that other developers who use OpenID might have made the same mistakes.

Mozilla developer Lloyd Hilaiel explained two attack scenarios enabled by the issue in a separate blog post.

One involves an attacker generating a valid and signed OpenID response from an identity provider that doesn't contain an email address field, and then appending their own email field and value to it. "This simple attack combined with behavior common in OpenID libraries can lead to vulnerabilities," Hilaiel said.

The other attack scenario involves an attacker adding an email address field at the beginning of a response that already has a signed email address field. Depending on how the OpenID library extracts values from OpenID responses, this trick might be enough to cause the unsigned email address value to be used instead of the legitimate one.

"In a popular OpenID implementation we found a lack of rigor in value extraction that could lead to vulnerabilities of this nature," Hilaiel said.

OpenID library authors should make sure that rigorous validation is performed on the values returned by an identity provider and that libraries clearly indicate which values are signed and can be trusted and which are not, he said. Site owners who use OpenID should also check their implementations to ensure that identifying values they rely on from OpenID responses are actually signed.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Internet-based applications and servicessecuritymobile securityAccess control and authenticationExploits / vulnerabilitiesinternetmozilla

Featured

Slideshows

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Examining the changing job scene in the Kiwi channel

Examining the changing job scene in the Kiwi channel

Typically, the New Year brings new opportunities for personnel within the Kiwi channel. 2017 started no differently, with a host of appointments, departures and reshuffles across vendor, distributor and reseller businesses. As a result, the job scene across New Zealand has changed - here’s a run down of who is working where in the year ahead…

Examining the changing job scene in the Kiwi channel
​What are the top 10 tech trends for New Zealand in 2017?

​What are the top 10 tech trends for New Zealand in 2017?

Digital Transformation (DX) has been a critical topic for business over the last few years and IDC is now predicting a step change as DX reaches macroeconomic levels. By 2020 a DX economy will emerge and it will become the core of what New Zealand industries focus on. From the board level through to the C-Suite, Kiwi organisations must be prepared to think and act digital when the DX economy emerges in 2017.

​What are the top 10 tech trends for New Zealand in 2017?
Show Comments