Mozilla unmasks security flaw in Persona, warns other OpenID implementers

OpenID-related vulnerability could have allowed attackers to impersonate users on websites using Mozilla Persona authentication

A vulnerability found recently in an OpenID-based feature of the Mozilla Persona online identity management service prompted the company to advise Web developers to check their OpenID implementations for similar issues.

Mozilla Persona allows users to verify their ownership of one or more email addresses and then use those addresses to authenticate on websites. Users have to remember only their Persona account password, because once they're logged into the service, authenticating on Persona-enabled websites only takes two mouse clicks.

To verify email addresses for use with Persona users typically have to click on a link sent to those addresses, except for Gmail and Yahoo addresses which are verified through what Mozilla calls "Identity Bridging," a feature based on the OpenID authentication protocol.

It's in this identity bridge feature that three security researchers from the University of Trier in Germany have recently found a serious vulnerability. The flaw, which was reported through the Mozilla bug bounty program and is now fixed, could have allowed an attacker to authenticate on Persona-enabled websites with the Gmail or Yahoo Mail addresses of other users.

The vulnerability had no bearing on the security of Gmail or Yahoo Mail accounts and only impacted the Persona service and websites that allow authentication based on it, Michael Coates, Mozilla's director of security assurance, said Wednesday in a blog post.

The initial patches were deployed last Friday and some additional ones on Tuesday of this week, he said.

The problem stemmed from incorrect security and behavior assumptions with two third-party OpenID libraries, meaning that other developers who use OpenID might have made the same mistakes.

Mozilla developer Lloyd Hilaiel explained two attack scenarios enabled by the issue in a separate blog post.

One involves an attacker generating a valid and signed OpenID response from an identity provider that doesn't contain an email address field, and then appending their own email field and value to it. "This simple attack combined with behavior common in OpenID libraries can lead to vulnerabilities," Hilaiel said.

The other attack scenario involves an attacker adding an email address field at the beginning of a response that already has a signed email address field. Depending on how the OpenID library extracts values from OpenID responses, this trick might be enough to cause the unsigned email address value to be used instead of the legitimate one.

"In a popular OpenID implementation we found a lack of rigor in value extraction that could lead to vulnerabilities of this nature," Hilaiel said.

OpenID library authors should make sure that rigorous validation is performed on the values returned by an identity provider and that libraries clearly indicate which values are signed and can be trusted and which are not, he said. Site owners who use OpenID should also check their implementations to ensure that identifying values they rely on from OpenID responses are actually signed.

Join the CSO newsletter!

Error: Please check your email address.

Tags Internet-based applications and servicessecuritymobile securityAccess control and authenticationExploits / vulnerabilitiesinternetmozilla

More about MozillaPersonaYahoo

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place