AOH :: HP Unsorted A :: VA3103.HTM

Adgregate ShopAd widget validation is vulnerable to replay attack



Adgregate ShopAd widget validation is vulnerable to replay attack
Adgregate ShopAd widget validation is vulnerable to replay attack



Adgregate is a "TechCrunch 50" startup that recently signed a
distribution deal with Google/DoubleClick [1].  As a service, they
offer a "viral widget" intended to be hosted on untrusted third-party
sites through which consumers can enter their credit card information.
 According to their website, they offer over 1.2 million products
through this service.  More details can be found at [2].

Consumers are able to validate that their data entry is secure by
clicking on a "validate this widget" button within the widget.
However, the widget proves itself by simply POSTing an (apparently)
fixed (per ShopAd id) string to a fixed URL, which is trivially
vulnerable to replay attacks.  For example, see the (clearly bogus)
widget at [3].  Of course, a more serious attacker would spend more
time reproducing the look-and-feel of the adgregate widget.

Here's the relevant HTML that fakes the validation functionality:

(Bob Ippolito first alerted me to this service and provided the above HTML form snippet.) [1] http://www.techcrunch.com/2009/04/06/adgregate-markets-scores-distribution-deal-with-googles-doubleclick/ [2] http://adgregate.com/web/demo/ [3] http://shinobi.dempsky.org/~matthew/adgregate.html

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.