TECHNOLOGY

Salt Labs identifies OAuth security flaw within Booking.com

Randy Pecora 4 weeks ago

0 0 3 minutes read

Safety flaw in Booking.com OAuth implementation could well presumably be same outdated to open account takeovers, nevertheless researchers stumbled on and flagged the teach sooner than it could perhaps perhaps presumably be exploited within the wild

Sebastian Klovig Skelton

Sebastian Klovig Skelton,
Senior reporter

Printed: 02 Mar 2023 13:00

Indispensable security flaws in Booking.com’s implementation of Beginning Authorization (OAuth) can also have enabled attackers to open sizable-scale account takeovers, placing thousands and thousands of of us’s sensitive personal data at probability, finds threat research by Salt Labs.

An commerce-current social login protocol, OAuth permits customers to log in to sites by their social media accounts, nevertheless by manipulating determined steps in Booking.com’s authorisation sequence, Salt Labs researchers stumbled on they’ll also fair hijack sessions and habits account takeovers.

Gaining total alter of of us’s accounts on this device would have enabled attackers to leak personal identifiable data and varied sensitive particular person data, as successfully as assemble any action on behalf of the particular person, including making bookings or cancellations.

The researchers said that any individual configured to log in to Booking.com by Facebook would had been susceptible and that – given the reputation of the fair and the truth that the positioning has as a lot as 500 million guests every month – thousands and thousands can also had been littered with a winning exploit.

The threat modified into once compounded by the truth that attackers can also then use the compromised Booking.com login to assemble net admission to to sister firm’s Kayak.com particular person accounts.

“OAuth has fleet change into the commerce current and is at advise in use by a total bunch of thousands of services and products across the arena,” said Yaniv Balmas, vice-president of research at Salt Safety.

“For this reason, misconfigurations of OAuth can have a significant influence on both corporations and customers as they leave precious data uncovered to unsuitable actors. Safety vulnerabilities can occur on any web plot, and as a results of fleet scaling, many organisations live blind to the myriad of security risks that exist within their platforms.”

Upon discovering the vulnerabilities, Salt Labs – the research arm of utility programming interface (API) security firm Salt Safety – adopted coordinated disclosure practices with Booking.com, and all points had been remediated. There just isn’t a proof of the failings having been exploited within the wild.

“On receipt of the story from Salt Safety, our groups true now investigated the findings and established that there had been no compromise to the Booking.com platform, and the vulnerability modified into once fleet resolved,” said a Booking.com spokesperson.

“We like the protection of purchaser data extraordinarily severely. No longer only will we form out all personal data based fully on the supreme world requirements, nevertheless we are continuously innovating our processes and programs to substantiate that optimum security on our platform, while evaluating and making improvements to the worthy security measures we already have in plot.

“As fragment of this commitment, we welcome collaboration with the realm security neighborhood, and our Worm Bounty Programme ought to be utilised in these instances.”

The researchers have also published a detailed technical breakdown of the vulnerability and the device in which it modified into once exploited, which runs by how they had been ready to string together three sperate security points to defend out account takeovers.

“The vulnerability described on this doc is a aggregate of three minor security gaps. Quite lots of the focus is on the foremost security hole, which permits the attacker to purchase some other direction for the redirect_uri,” they said.

“Even as you function an integration with Facebook or some other vendor, it’s extraordinarily crucial to give sharp-coded paths for the redirect_uri within the Facebook configuration.”

Consistent with the Salt security advise of API security story, Q3 2022, Salt customers skilled a 117% develop in API attack traffic while their total API traffic grew 168%

The enhance pattern has viewed an increasing probability of high-profile incidents linked to API traffic this year, including the sizzling attack on Australian telco Optus, which saw names, addresses, dates of initiating, phone numbers, e-mail addresses, and using licence and passport data pertaining to to 11 million customers stolen and held to ransom – an incident so critical in its scope that the Australian authorities is now planning to amend its telecoms security rules.