Hacker News Reader

Comment by eastern | Hacker News Reader

The password reset mail is yet another train wreck.

I received this email. The reset password link in it is NOT https. If I manually change the http to https it turns out that the server, click.msg.salesforce.com, is returning a certificate that is only valid for click.s10.exacttarget.com

View on HN

I think all this link does is redirects to the 'Reset password' page (i.e. https://id.heroku.com/account/password/reset), with email address pre-populated, then shows a button to email the user a separate reset password link.

So I think the lack of 's' in http in the original link doesn't matter.

If I'm wrong, could you please explain why (I am reasoning as best I can, and am not an expert, and keen to learn).

I guess a concern could be that since this URL is insecure, it could redirect you wherever assuming your network is compromised (either their malicious URL, or even HTTP for the legit Heroku site assuming you don't have HSTS on it).

Obviously, you've checked the URL and seen that it's legit after, but realistically you should expect a legit email to not be feeding you a potentially insecure link.

Right. If you're on top of things then using plain HTTP links here didn't make anything worse, but if you aren't it's yet another unnecessary gift to bad guys because it's yet another opportunity for customers to get phished.

Sorry, meant if the end user's network was compromised, not the server's.

Whether or not you're on top of your game, HTTP leaves you vulnerable to MITM attacks[0]. So this would leave the end user vulnerable to any of these attacks even assuming Heroku has everything else perfect.

[0] https://en.wikipedia.org/wiki/Man-in-the-middle_attack

You are right, by itself it doesn't matter. All Heroku users should be smart enough to figure this out themselves.

However, Heroku should also be smart enough to figure out that all links should be https and servers should have valid certificates.

For a company to make such basic security-related mistakes while in the middle of a bad security incident doesn't look good, to put it politely.

It sort of explains how they got where they are.

With a non-HTTPS link, an attacker could trivially MITM the connection and forward it to a domain like id.hеrоku.com instead with a completely valid SSL cert with lock symbol. In case you can't realize, that domain is made up of unicode homoglyphs and would be nearly completely indistinguishable from the real heroku.com in some browsers. They could have a website resting on that domain that is indistinguishable from the normal heroku website and simply acts as a form proxy, relaying the real credentials provided by the user to the actual heroku website, performing the password reset successfully while storing the legitimate credentials permanently and additionally scraping the user's cookie to utilize their access to the panel post facto even if the user has 2FA authentication enabled. It's a monumental fuckup.

I certainly couldn't tell the difference, wow.. id.hеrоku.com and id.heroku.com look identical to me. I see the problem now.

How hard is it for an attacker to do a MITM? Would the attacker need physical access to the user's wifi router?

pay for colocation with BGP access with a fake ID or compromise any BGP-announcing router in the entire world (I've found cisco routers with announce access, with default credentials, on networks that don't do any kind of prefix filtering many times before) and you can trivially MITM most any network in the world with very minimal impact. I recommend you watch to Kapela and Pilosov's talk from DEFCON 16 to see how easy it is: https://www.youtube.com/watch?v=oWdjsfsS_Do

or if you don't want to do it via BGP announcement you can just compromise any of the devices that are along the route between the client and the server. BGP is the rocket launcher of worldwide circuit compromise, but there's many other guns you can pick up

Thanks for the recommendation, was very interesting. 14 years old though, things would have changed since, I hope?

Nope, nothing has changed! You can still MITM with BGP in the exact same manner! BGP is like SS7 -- once you get access to use it, it is wide open and completely insecure and no effort has been made to use it. All its security is predicated on the idea that anyone with access will have too much on the line to abuse it, and responsibility for monitoring announcements for your own IP is considered your own problem. Ask around -- how many people in your social circle of admins keep track of rogue announcements? How many would notice if this were going on?

More colocation facilities in the US and Europe now do prefix filtering at egress - but this matters little, as there are still quite enough that don't. In contrast, there's virtually no prefix filtering in Africa or Asia (remember when an accidental BGP announcement from Pakistan killed YouTube worldwide?)

The real problem is having a link in the email at all. How many readers will check to make sure the email is from a non-unicode domain and that an https link in the email goes to a non-unicode domain?

Along with the vague status updates that provide no information, this has been the most shockingly bad part of the response from my POV, as well. This felt like a phishing email (I know it is not, but given that emails were likely compromised along with OAuth tokens, an attacker could totally be sending - even alongside a legit campaign running as announced on their status site). Would have expected a valid HTTPS cert on the links in an email as sensitive as this one!

Salesforce isn't a small new startup where this can be understood as a cost of doing business, they are a tier-1 provider to the largest companies in the world. Unacceptable (but still sending #Hugops to the team dealing with this mess!)

I use HTTPS-only mode in Firefox and this is incredibly common. I think a lot of services are sending all mail through a click-tracking services and a lot of these redirect via HTTP.

I assumed that was a phishing email and didn't proceed.

If it isn't a phishing attempt it would be really surprising to me that they would use http. BTW, https://exacttarget.com redirects to an official Salesforce product page, but that doesn't guarantee it to not be phishing.

> If it isn't a phishing attempt it would be really surprising to me that they would use http.

Why? Technical incompetence is a systematic problem that comes from the top down. This is what happens when mediocrity becomes acceptable and takes priority over correctness.

I would suggest moving all of your business from Heroku ASAP. These kind of mistakes strongly suggest nobody capable of intelligent thought makes decisions at Heroku, nor has for awhile.

The website seems to be down at least for me.

> If it isn't a phishing attempt it would be really surprising to me that they would use http

Spammers are the first to adopt https and all the mail and dns security stuff. It never was a sign of legitimacy

Reply on news.ycombinator.com