Code replay attack on the myGovID Scheme

https://www.thinkingcybersecurity.com/DigitalID/

by shakna • 4 years ago

99 39 4 years ago

jaclaz• 4 years ago

It seems like the matter is a "won't fix" since september 2020.

Responsible disclosure history
This problem was disclosed on 19th August 2020 to the Australian Signals Directorate, with an indicative expectation of a 90-day disclosure period. ASD communicated it to the ATO. At a meeting on 18th September 2020, ATO told us they did not intend to change the protocol, at which point we immediately informed them that we would make a warning to users public on Monday 21st September.

m1keil• 4 years ago

From UI/UX point of view, it even got slightly worse since 2020: The user no longer needs to type the code. Instead, the same code is prompted and the user just needs to click "Accept" or "Decline", with "Accept" being emphasised.

technion2• 4 years ago

It wasn't entirely clear if this is a disclosure I missed on 21st September 2020, or if they agreed to publish then sat on it for a year and a half. I think the answer is the former - the Youtube has a publish date from September 2020.

Aransentin• 4 years ago

This occurs (occurred?) in practice for the Swedish e-ID system (BankID). There are examples of companies that don't want to pay to verify identities, and so will instead replay the codes to log directly into the Swedish tax agency website as the user to read their information from there.

News article about it, in Swedish: https://www.svd.se/a/yvMvle/skatteverket-utfardar-bank-id-va...

hayyyyydos• 4 years ago

I have a bigger concern with myGovID. It pushes a notification, with "accept" or "decline". What happens if you accidentally hit "accept" when it wasn't you that logged in? There is no way to end a session/revoke a token from the app.

krater232• 4 years ago

Reads for me like making trouble out of nothing.

Maybee I overread anything, but in general a Man-in-the-Middle is everytime possible when the user is not able to check if his communication partner is trustworthy.

The 'Analysis of impact' only bespokes the probability, but not what can happen and what besides of vandalism can be done with a login. And which goal a attacker could have that is valuable enough to justify the effort. Maybee nothing?

The mitigations beside 'Short term - for users' are all reading for me like bullshit. Displaying the URL in the App will not change anything, when the user didn't understand what he see in the browser, why should he understand it in the app? Clearly, with a private/public key infrastructure, this could be fixed, but unrolling a thing expensive like this is questionable for a simple Man-in-the-Middle attack with this little impact.

Niksko• 4 years ago

Sure, the mitigation isn't perfect. But I think the wider point is that as usual, the Australian government have implemented a shit scheme, full of obvious and rookie mistakes, when they should have just used a well known open standard.

Spelling out the very simple flaw is a means of underlining how poor this system is.

krater232• 4 years ago

Reads like you know more than I. They use (more) than the state of the art security of Amazon, eBay, Facebook, Steam, Paypal and so on. Is the impact bigger than the impact that can happen on this platforms? And if yes, what is it?

Which impact can happen on Amazon, eBay, Steam? An attacker can steal your account and some hundreds of dollar of your money.

technion2• 4 years ago

I'm not convinced a well known standard would be any better against what basically comes down to "users might get phished". OAuth phishing against Microsoft accounts is a massive thing, I'm seeing it just as much as password phishing these days. It's regularly successful.

Aechoo3u• 4 years ago

What I find problematic with MyGovId is how easy is to steal someone's identify. All you need are two documents like your Medicare card and driver licence.

These are documents that most people carry around in their wallet. Just gaining access for a few seconds to someone's wallet and take a couple photos to these documents, is all you need to impersonate this person through myGovId.

There are even night clubs where they make a copy of your driver licence as a requirement for entry.

In addition, as usual with any software system related to the Australian Governement, MyGovId simply does not work very well. For example, mine stopped receiving the 4-digit verification codes after an Android upgrade. After countless hours of resetting the application, re-entering the identity data, etc. I had to end up using my wife's phone.

bigDinosaur3• 4 years ago

Of course it's a student who has Vanessa Teague as an advisor. For reference, the Australian government leaned heavily on a major Australian university for her to be fired: https://www.theguardian.com/australia-news/2020/mar/08/melbo... as retribution for showing that 'deanonymised' data was absolutely not truly anonymised.

Thank god we don't have electronic voting.

mellosouls2• 4 years ago

Reading the article you've linked to, although the government department doesn't come off well, I can't see the part where "the Australian government leaned heavily on a major Australian university for her to be fired".

bigDinosaur3• 4 years ago

“The letter hints strongly at negative consequences for the university as a whole, particularly if I notified the affected journalist. The university did pass on that pressure, quite unambiguously, but I can’t really blame them.”

I suppose they 'hinted' which is what you do in all good threats. In general, the government in Australia is fairly hostile to cryptographers and security researchers that find problems with governmental projects.

Stiffly64713• 4 years ago

In Belgium they use https://www.itsme-id.com/ i don't think it's sensitive to this kind of attack.

hleszek• 4 years ago

It's great but it's kind of strange to depend on a private entity to log in on government websites.

https://geeko.lesoir.be/2022/06/28/les-belges-pourront-obten...

ParanoidShroom• 4 years ago

I think it's a UX friendly wrapper around the poor UX super annoying official 'e-id'. I don't think it's me would have space in the market if the official e-id was as easy to use and reliable as the official one.

toolslive• 4 years ago

They (belgian govt) are working on an alternative.

https://tweakers.net/nieuws/198482/belgische-overheid-werkt-... (in dutch)

Stiffly64713• 4 years ago

you mean that same government that has the largest stake (20%) in the company?

nomilk3• 4 years ago

We strongly believe that instead of inventing their own authentication protocol, they should migrate to an open standard

Also

We notified the Australian Government of this problem, and were told by the Australian Tax Office that they do not intend to make the recommended changes to their protocol. [1]

Aust Govt breaks multiple web-security 101 rules, bears no cost nor responsibility for it, and the cherry on top: they refuse to do anything about it.

[1] https://www.youtube.com/watch?v=TgPdVbUbtBM&t=311s

greggsy2• 4 years ago

Isn’t this just a phishing attack? Almost any MFA service is vulnerable to this, but it’s not at all insurmountable if the user is sufficiently trained during the onboarding process. They even have an app which can leverage to help train users around the risks.

App-based OTP and push seems like a reasonable middle ground, short of supplying everyone with FIDO keys. It’s still better than SMS or email - or no second factor at all.

ntrz• 4 years ago

Is it a second factor? The article makes it sound as though the MyGovID authorization is all that's needed to log in, and the official site (https://www.mygovid.gov.au/) says it's used "instead of usernames and passwords."

alfiedotwtf• 4 years ago

I don't know how it goes these days, but for a while only a few years ago, there were departments in Defence reading their email via HTTP (not httpS) webmail (IIRC it was Squirelmail).

nhoughto• 4 years ago

Worked on something very similar and we chose not to move ahead with this kind of feature because of the phishing risk, without redefining the problem (like webauthn, Fido etc) it is very easy to dupe a user / replay attack. Most users don’t pay that much attention and friction hurts adoption.

Kind of funny the govt shipped the feature even with the spam risk and our more commercially oriented competitor product didn’t. You’d Hope they would be raising the bar for security not lowering it.

nomilk3• 4 years ago

I couldn't spot a date on the article itself (perhaps it could be added to the HN post title); in case others are curious, wayback machine first scanned it 21 Sept 2020.

https://web.archive.org/web/20200101000000*/https://www.thin...

oxplot• 4 years ago

Am I missing something or is this just a run-of-the-mill phishing attack? If it is, then every website under the sun that doesn't use a FIDO or WebAuthn is susceptible to it. How is this any different?

In fact, Google has a very similar 2FA option where you can simply press a Yes/No on a mobile device you are already signed into, in order to authenticate another device. None of the this PIN stuff is going to do much to reduce the odds of phishing.

llamaLord• 4 years ago

Yeah but Google requires you to also input a password, this does not. It only needs your email.

rjblackman• 4 years ago

is this still relevant? the article is 2 years old, was the flaw addressed?

shakna• 4 years ago

Not only was the flaw unaddressed, the decision was made to make it harder to see who is requesting the code - the app now only shows the user an accept/reject button. The replay attack can be done entirely passively, without any awareness that it has taken place, even by a user who is paying attention.

to1y• 4 years ago

Bit rich calling it code or even attack. Its a fake login portal? There are much worse problems on aus gov sites which all look and function like a hobbyists early project for the first job.

Code replay attack on the myGovID Scheme

Related Stories