Menu
Mozilla unmasks security flaw in Persona, warns other OpenID implementers

Mozilla unmasks security flaw in Persona, warns other OpenID implementers

OpenID-related vulnerability could have allowed attackers to impersonate users on websites using Mozilla Persona authentication

A vulnerability found recently in an OpenID-based feature of the Mozilla Persona online identity management service prompted the company to advise Web developers to check their OpenID implementations for similar issues.

Mozilla Persona allows users to verify their ownership of one or more email addresses and then use those addresses to authenticate on websites. Users have to remember only their Persona account password, because once they're logged into the service, authenticating on Persona-enabled websites only takes two mouse clicks.

To verify email addresses for use with Persona users typically have to click on a link sent to those addresses, except for Gmail and Yahoo addresses which are verified through what Mozilla calls "Identity Bridging," a feature based on the OpenID authentication protocol.

It's in this identity bridge feature that three security researchers from the University of Trier in Germany have recently found a serious vulnerability. The flaw, which was reported through the Mozilla bug bounty program and is now fixed, could have allowed an attacker to authenticate on Persona-enabled websites with the Gmail or Yahoo Mail addresses of other users.

The vulnerability had no bearing on the security of Gmail or Yahoo Mail accounts and only impacted the Persona service and websites that allow authentication based on it, Michael Coates, Mozilla's director of security assurance, said Wednesday in a blog post.

The initial patches were deployed last Friday and some additional ones on Tuesday of this week, he said.

The problem stemmed from incorrect security and behavior assumptions with two third-party OpenID libraries, meaning that other developers who use OpenID might have made the same mistakes.

Mozilla developer Lloyd Hilaiel explained two attack scenarios enabled by the issue in a separate blog post.

One involves an attacker generating a valid and signed OpenID response from an identity provider that doesn't contain an email address field, and then appending their own email field and value to it. "This simple attack combined with behavior common in OpenID libraries can lead to vulnerabilities," Hilaiel said.

The other attack scenario involves an attacker adding an email address field at the beginning of a response that already has a signed email address field. Depending on how the OpenID library extracts values from OpenID responses, this trick might be enough to cause the unsigned email address value to be used instead of the legitimate one.

"In a popular OpenID implementation we found a lack of rigor in value extraction that could lead to vulnerabilities of this nature," Hilaiel said.

OpenID library authors should make sure that rigorous validation is performed on the values returned by an identity provider and that libraries clearly indicate which values are signed and can be trusted and which are not, he said. Site owners who use OpenID should also check their implementations to ensure that identifying values they rely on from OpenID responses are actually signed.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags Internet-based applications and servicessecuritymobile securityAccess control and authenticationExploits / vulnerabilitiesinternetmozilla

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments