Afrihost's insecure client portal

[AfriMan]

No, I would not take responsibility for it. You yourself said that this issue existed since the beginning of time and that your company and security IT staff "relies" on people not sharing information. Email is not secure unless it is encrypted which I doubt you do. If I come across issues, I contact the company involved and hope that they will fix the issue.

In this scenario someone else found it, and I was perplexed (and honestly annoyed) by your ignorance and responses (especially considering that you had a security leak last year and I would have thought that when this happens a company would go through thorough checks to cover the whole IT landscape).

It is a very naive assumption to think that just because a company was alerted about a security issue, that the threat only starts to exist at that point in time. In your case for example, the possibility of peoples email accounts being compromised and then access gained to their AH was and is a real threat since you implemented this functionality. Worst of all is that you would not have auditing in place to figure out if the information was accessed by the legitimate user.

I honestly would have by now revoked the convenient access function until you have implemented proper access controls. Companies should be thankful for people reporting issues like that and not trying to persecute them - everyone knows that the real hackers are the people who have been abusing your system and bypassing your security controls for years and would obviously not alert you to those issues.

OK, that pretty much answers what I was asking.

 

[FalconZA]

i am perplexed that as a supposed tech-savvy forum some people on here deem it perfectly acceptable to forward emails intended for the Client on to other people? and then to blame the provider of the email for providing a convenience?

SSO is a thing people....its been around for awhile....its not afrihosts fault that you forward on private email to your whole office.

I for one love it that i don't need to put in my log in details at every click of my mouse...that's the point of convenience....then again i Don't send private email to whoever i feel like.

 

[Kosmik]

i am perplexed that as a supposed tech-savvy forum some people on here deem it perfectly acceptable to forward emails intended for the Client on to other people? and then to blame the provider of the email for providing a convenience?

SSO is a thing people....its been around for awhile....its not afrihosts fault that you forward on private email to your whole office.

I for one love it that i don't need to put in my log in details at every click of my mouse...that's the point of convenience....then again i Don't send private email to whoever i feel like.

Actually no-one is saying that forwarding a private mail is correct. Folks are just saying that it is a poor security approach to allow the automatic authentication of a user by a static url. As I've said, if it prompted for a password or even if there was an initial cookie, then it wouldn't be a problem and most "tech savvy" users would be happy. The scary thought here is that email is not secured ( unless Afrihost have suddenly started encrypting their mail ) and any mail needs to leave the security of Afrihosts network to get to the security of the reciepients mail server. Not to mention the server to the client channel either.

The basic fact is that those mails can be intercepted and mined. A little change on the ISP's side, would make the data effectively useless.

 

[JerryMungo]

i am perplexed that as a supposed tech-savvy forum some people on here deem it perfectly acceptable to forward emails intended for the Client on to other people? and then to blame the provider of the email for providing a convenience?

SSO is a thing people....its been around for awhile....its not afrihosts fault that you forward on private email to your whole office.

I for one love it that i don't need to put in my log in details at every click of my mouse...that's the point of convenience....then again i Don't send private email to whoever i feel like.

Wat? Who says the email is not intended for the audience of my entire office who share the ADSL line - I / we are the client. Go read the email and tell me what's not intended for our internal office consumption.

 

[FHTheron]

Another point worth mentioning is the fact that the displayed link (when viewed as html) does not match the real link. This is something that some users might have been told means it is a phishing attack and that they should not follow it. Granted, in this case the link at least looks a lot like the real link, but if you are considering users who do not know how to let the browser save the password, you can also assume that that user will be afraid of clicking the link.

I'm sure I've heard the warning a lot in the past, but can't remember where. So here's just one google result:
http://support.apple.com/en-us/ht4933

 

[MagicDude4Eva]

i am perplexed that as a supposed tech-savvy forum some people on here deem it perfectly acceptable to forward emails intended for the Client on to other people? and then to blame the provider of the email for providing a convenience?

SSO is a thing people....its been around for awhile....its not afrihosts fault that you forward on private email to your whole office.

I for one love it that i don't need to put in my log in details at every click of my mouse...that's the point of convenience....then again i Don't send private email to whoever i feel like.

I am equally perplexed about the lack of knowledge of some people. Your understanding of SSO is flawed. Afrihost has not provided an SSO mechanism as it is merely a link with a non-expiring login token. A traditional SSO mechanism would go at least through a handshake mechanism (i.e. user clicks on link and target system then queries the authenticity of the request) to validate the authenticity of the request and that it originates from a valid user/source system.

Afrihost's interpretation of "secure mail" has nothing to do with PGP/encryption, but only means that it is supposed to be used by the person receiving it - THIS IS NOT SECURE!. It also shows great ignorance to assume that email transport is secure, as it is not, as most providers do not support TLS. This really means, that email can be intercepted. We also know that the users targeted by those "convenience links" are supposedly not computer savvy which in itself is scary as those very same users would need every protection we can offer them.

TBH, anyone in the IT industry (irrespective of the job function) should be familiar with the top-10 OWASP security issues (https://www.owasp.org/index.php/Top_10_2013-Top_10), and our industry would be a much safer place.

What Afrihost has done is among the top-10 security flaws: A2-Broken Authentication and Session Management and one does not need to be an expert to figure this out. It is really common sense.

TL;DR: Attack behaviour for A2: Airline reservations application supports URL rewriting, putting session IDs in the URL:

http://example.com/sale/saleitems?jsessionid=2P0OC2JSNDLPSKHCJUN2JV&dest=Hawaii

An authenticated user of the site wants to let his friends know about the sale. He e-mails the above link without knowing he is also giving away his session ID. When his friends use the link they will use his session and credit card.