I recently did some investigation on the security of some popular web portals -
indiatimes.com,
rediff.com,
in.com and
sify.com. Each of these portals provide free email, and according to
Alexa and
Vizisense, have a lot of users. So naturally, web security should be a big concern for them.
To my surprise, none of these websites seem to care about user security. There are many loopholes on their websites, and I am surprised there haven't yet been reports of attacks on these sites.
I. Cross Site ScriptingCross Site Scripting (aka XSS) occurs when an attacker is able to insert javascript code into a webpage by providing special input sequences. The attacker can exploit this vulnerability to steal personal information from your account.
To exploit this vulnerability, an attacker carefully constructs a url and sends it to the victim via an email, or a social networking website. Once the victim clicks the link, his session information is made available to the attacker. At this point, its as if the victim logged into the website and gave it to the attacker.
Each of the 4 websites has XSS vulnerabilities
on almost every page. If these websites have to
prevent XSS, they have to pretty much revisit every page on their website and make changes. Daunting task, to say the least.
II. Update Password & Password Recovery
Assume you forget to signout from email, and your colleague uses your computer and gets into your account. Or assume that an attacker somehow got access to your session using the XSS trick mentioned above. Should they be allowed to reset your password, or worse, shown your current password?
Definitely Not. All sensitive pages must require the user to re-enter the password. That's a basic tenet. Thats why bank websites require you to enter a separate transaction password before transferring money. Unfortunately, all portals (other than rediff.com) violate this in some way or the other.
Indiatimes doesn't let you change the password without asking for your current password. But your colleague can always perform the following operations -
- Change the security question and answer
- Logout and click on "Forgot Password"
- Enter the security question and answer
- View the current password
- Login again (she now has the password), and reset the security question and answer to previous values.
Sify.com is a little better. When you try to change your password, it asks you for your current password OR your security answer. But, the security answer is present in the HTML source, so your colleague can just read the answer and update your password. The only good thing is that she won't know your current password, so you will figure out something is wrong the next time you try to login (by which time its already too late).
With
In.com, your colleague can update the secondary email address , and then reset the password via the 'Forgot Your Password' flow. Similar to sify, your current password is not compromised.
Rediff.com requires you to enter password on all sensitive screens, and so your password cannot be reset or compromised.
III. Remember Me Functionality"Remember Me" functionality allows your session to remain active for extended periods of time, usually till you log out. In order for this to work, websites store a random key in a persistent cookie. This random key identifies the user, but is cryptographically strong making it impossible for attackers to guess the token.
Rather than using such tokens, Indiatimes directly stores the user name and password in the persistent cookie. Anyone monitoring the http traffic can see your credentials. And anybody who knows to read cookies from a browser, or who knows a little about XSS can get the credentials.
Other portals, thankfully, don't have these problems
IV. SQL Injection
SQL Injection is best explained by the following comic (from
xkcd.com)
An attacker enters special characters in various input fields on the website, and they are treated as commands by the underlying database. It is an easy way to steal information, or delete critical information from the database. Very dangerous if such a vulnerability exists, but very easy
to prevent.
Sify.com has a pretty serious SQL Injection Vulnerability. To make things easier for the attacker, the SQL query that is executed is actually printed in the underlying HTML. For obvious reasons, I can't disclose the specific page that has this vulnerability.
Other websites may or may not have SQL Injection vulnerabilities, I just didn't do a thorough analysis.
V. Using One-Way Hashes to store passwordsThe first rule to storing sensitive information is simple - don't store it at all. Passwords and password recovery answers fall in this category. It is
never advisable to store passwords in the database. Instead, the
salted hash of the password should be stored in the database.
Indiatimes doesn't use this technique. It stores the passwords (perhaps in cleartext?) in its database, and even emails them back to you if you request it to do so. This means any indiatimes employee, contractor or vendor can read your credentials. It means if the database is compromised, every user in the system will have his account compromised. And because most users reuse their passwords, other accounts are likely to be compromised as well.
Other websites don't seem to store the passwords, but there is no way to be sure of that unless you work for them . We just know they don't send back the original password.
VI. Cross Site Request ForgeryCross Site Request Forgery, or XSRF, allows an attacker website to issue commands to another website from the users browser. To the target website, the commands seem to come from the user himself, making this attack very difficult to identify.
XSRF is a pretty serious threat, but unfortunately there is no way to fix it without first fixing XSS holes. In fact, if a website has XSS vulnerabilities, an attacker doesn't have to bother about using XSRF.
Neverthless, all 4 websites have XSRF vulnerabilities.
What can I do?
As a user -
- Don't store any important information on these portals. This means you shouldn't use their emails for any business or official work.
- When you are logged on to these websites, do not click on any ads or links that come in an email. Also, avoid visiting other websites, especially random ones that appear in a search result.
- After use, immediately log out and clear your browser cookies.
- Finally, send emails or feedback to the developers of these portals. If enough number of people complain, I guess they will start fixing these issues.
As a developer -
- Familiarize yourself with the various web security threats. The OWASP website is a great place to get started. You may want to go through the developer guide, and the OWASP Top Ten.
- If you work with any on these web portals, feel free to contact me so that I can provide additional details on these vulnerabilities. For obvious reasons, these cannot be shared publicly.
Thanks for reading!
Sripathi Krishnan
