Welcome!

.NET Authors: Elizabeth White, Jayaram Krishnaswamy, Keith Mayer, RealWire News Distribution, Kevin Benedict

Blog Feed Post

Major OAuth, Open ID Security Flaw Can’t Be Fixed by Facebook or Microsoft

Online Security

Following in the steps of the OpenSSL vulnerability Heartbleed, another major flaw has been found in popular open-source security software. This time, the holes have been found in the login tools OAuth and OpenID, used by many websites and tech titans including Google, Facebook, Microsoft, and LinkedIn, among others. Wang Jing, a Ph.D student at the Nanyang Technological University in Singapore, discovered that the serious vulnerability “Covert Redirect” flaw can masquerade as a login popup based on an affected site’s domain. Covert Redirect is based on a well-known exploit parameter. For example, someone clicking on a malicious phishing link will get a popup window in Facebook, asking them to authorize the app. Instead of using a fake domain name that’s similar to trick users, the Covert Redirect flaw uses the real site address for authentication.

Read the full story at CNET.

Read the original blog entry...

More Stories By Shelly Palmer

Shelly Palmer is the host of NBC Universal’s Live Digital with Shelly Palmer, a weekly half-hour television show about living and working in a digital world. He is Fox 5′s (WNYW-TV New York) Tech Expert and the host of United Stations Radio Network’s, MediaBytes, a daily syndicated radio report that features insightful commentary and a unique insiders take on the biggest stories in technology, media, and entertainment.