Hacker News Reader

Comment by jonahx | Hacker News Reader

nice work, although it would be nice to have an end to end example (what i, the user, do at each step, and what the hacker is doing) and what the final result of the hack will be. in particular, the practical meaning of these two sentences:

> Now to all OAuth flows Facebook will respond with Attacker's profile information and Attacker's uid.

> as long as attacker can replace your identity on Facebook with his identity and connect their Facebook account to victim's account on the website just loading CLIENT/fb/connect URL.

was not clear to me.

View on HN

I believe it would work as follows.

- User wants to create a new account at website.com

- website.com has been compromised to inject the attackers facebook login

- User chooses to create an account by linking with facebook. They click Link with Facebook and are redirected back to website.com logged into their new account

- Attacker can now access User's account on website.com by logging in with the injected facebook credentials

It seems like the attacker would need to somehow generate a unique facebook login for each exploited user though. I think if you try to "connect with facebook" with a website that already has an account for the facebook login it often logs you in rather then creates an additional account.

issue 1: when victims visits attacker's page, I relogin them in my facebook and load /fb/connect URL, which boils down to attaching my facebook to victim's website account = hijacking.

It wasn't to me either. I think it has something to do with the 302 redirect. I've never used FB Connect though, so maybe the 302 involves the fb/connect url? Replace your FB url with the victim's, and since you've already authenticated with FB, the web site will accept your token as authorization to the victim's account?

302 redirects preserve the URL's hash, which contains the access token in the JS SDK.

Thus, if a site has URLs that can be constructed to make a 302 to an attacking site, like https://www.google.com/redirect?url=http://www.example.com/, it's possible to craft a redirect URL that would take you to the authentication dialog but return the token to a redirect URL which will in turn pass the token to the attacker.

Reply on news.ycombinator.com