Open redirects – a vulnerability class no one but attackers cares about

Re:Open redirects – a vulnerability class no one but attacke... by rocqua on Friday January 04, 2019 @03:07AM (#18822623)

There is also value in customer trust. If a customer gets burned by a Google.com link, they are going to check next time they see such a link. Google would be better of if customers felt 'oh, it is Google so it must be safe'.

[ Parent | on HN ]

Re:Open redirects – a vulnerability class no one but attacke... by wtracy on Friday January 04, 2019 @04:25AM (#18822835)

That might not be an issue for Google, but I could see it being a big problem for a company that relies heavily on projecting a "family friendly" image (think Disney).

[ Parent | on HN ]

Re:Open redirects – a vulnerability class no one but attacke... by dsfyu404ed on Friday January 04, 2019 @07:58AM (#18823642)

Back in the day you could change some URL parameters and make it look like Toys R Us was selling firearms on their website because they used the same ecommerce back end as a sporting goods store. Like you'd go to the URL and it would be a hunting rifle (or whatever) but it would be on the Toys R Us site.

I don't think Toys R Us was ever harmed but it was mildly amusing and I'm sure a few people's panties got knotted after they found out Toys R Us doesn't actually sell firearms and they got all enraged over nothing.

[ Parent | on HN ]

Re:Open redirects – a vulnerability class no one but attacke... by cosmie on Friday January 04, 2019 @03:58PM (#18827542)

I hadn't heard of this issue specifically, but it sounds like you may be talking about eBay Enterprise[1]. They ran a lot of e-commerce operations for brick and mortar stores at one point, including both Toys R Us and Dick's Sporting Goods.

[1] https://en.wikipedia.org/wiki/EBay_Enterprise

[ Parent | on HN ]