On Tue, 25 Aug 1998, Leonid S. Knyshov wrote: > Dear Bugtraq readers and security at Bellsouth > > Upon examining my log files, I came across an interesting fact. > > Background: > As part of my Internet marketing efforts, I read web log files daily to > see if anything interesting comes up. Yes, this basic issue has been posted several times to bugtraq in the past six months or so. It applies to most web based mail services. The basic problem is that the URL of a page is _not_ treated as confidential information by the client and must not be used as such. It can be exposed from many places; eg. insecure logs of a proxy, referer header, user's history (use a public access terminal to check your mail, log out, assuming the service doesn't invalidate the session if you logout "properly", someone can walk up and use your account), etc. This is one of the situations where cookies are actually one of the better solutions. HTTP authentication is even better, but many people dislike it because they can't control the login prompt and due to how it can be cached by the client. > > Just today I was reading my logs this way: grep welcome.html access.log > > And among others there was this entry: > > *.*.*.* - - [25/Aug/1998:07:28:02 -0700] "GET /welcome.html HTTP/1.0" 20 > 0 4427 > "http://webmail.bellsouth.net/WebEmail?FormName=ReadMail&WebMail-Action=W > ebMail-MessageContent&WebMail-MsgNdx=3&WebMail-St=&WebMail-MailBox=INBOX&SEQ=Xnn > -43_tE0_PB9GePBFs8txjXohB-IdE&WebMail-MsgCount=69&locale=en&ver=2.0.0&dyn=" > "Moz > illa/3.02Gold (WinNT; I)" > > Naturally that sparked my interest, so I went to that exact same URL. I > was greeted with a message that 2 hours passed and I am logged off, but > that's not a good thing. > > Concerns: > Bellsouth.net webmail customers accounts may be easily abused Not necessarily. The typical system will only allow access from the same IP address, so if someone tries to access it from a different IP address, it won't work. Some (eg. eudoramail) allow access to the whole /24 (or something resembling that), presumably to deal with proxies. Now the problem arises with proxies: what if you are coming through a proxy? What if someone else can come through the same proxy? Then they can access your mailbox. And, of course, you can think of a million variations using javascript to get them to follow the link but that gets boring.
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:13:29 PDT