Browse Definitions :
Definition

covert redirect

Covert redirect is a security flaw that allows attackers to exploit an open redirect vulnerability.

Open redirects are a failure to check that a redirected URL is a valid one. The covert redirect attacker takes advantage of that weakness to pop up a fraudulent login window, subsequently stealing the login info and redirecting the user to a page that installs malware for more criminal purposes, such as identity theft.

Covert redirect was discovered by PhD student Wang Jing from Nanyang Technological University in June 2014. Wang Jinf's site, tetraph.com, claimed to demonstrate a vulnerability that affected major sites including Facebook, Google, Yahoo and Microsoft using Oauth and OpenID. According to Jing, the vulnerability enabled open redirect by stealing an Oauth token.

Contrary to initial reports, experts say covert redirect is not a Oauth- and OpenID-specific flaw but is more a problem of how security is handled in conjunction with enabling open redirect to third-party websites.

This was last updated in July 2014

Continue Reading About covert redirect

SearchCompliance
  • OPSEC (operations security)

    OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines ...

  • smart contract

    A smart contract is a decentralized application that executes business logic in response to events.

  • compliance risk

    Compliance risk is an organization's potential exposure to legal penalties, financial forfeiture and material loss, resulting ...

SearchSecurity
  • email virus

    An email virus consists of malicious code distributed in email messages to infect one or more devices.

  • key fob

    A key fob is a small, programmable device that provides access to a physical object.

  • identity theft

    Identity theft, also known as identity fraud, is a crime in which an imposter obtains key pieces of personally identifiable ...

SearchHealthIT
SearchDisasterRecovery
  • What is risk mitigation?

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • change control

    Change control is a systematic approach to managing all changes made to a product or system.

  • disaster recovery (DR)

    Disaster recovery (DR) is an organization's ability to respond to and recover from an event that affects business operations.

SearchStorage
  • JBOD (just a bunch of disks)

    JBOD, which stands for 'just a bunch of disks,' is a type of multilevel configuration for disks.

  • bare-metal restore

    A bare-metal restore (also referred to as bare-metal recovery or bare-metal backup) is a data recovery and restoration process ...

  • mSATA SSD (mSATA solid-state drive)

    An mSATA SSD is a solid-state drive (SSD) that conforms to the mSATA interface specification developed by the Serial ATA (SATA) ...

Close