#ibibo

EXCLUSIVE: BIGO to double contracts with content creators in India, spend millions- Technology News, Firstpost

[ad_1]

Sunny SenFeb 05, 2020 10:29:00 IST

Singapore-based social media platform BIGO Live will double its contracts with content creators in 2020, which could amount to at least $200 million, to have a wider footprint in India, the world’s second-largest internet market after China.

By the end of 2020, the company would have 30,000 contracts with 30,000 content creators, Nagesh Banga, Deputy…

Indian Railway Catering and Tourism Corporation (IRCTC) is good to go running its first train — Delhi-Lucknow Tejas Express — from October 4. From free travel protection of ₹25 lakh each to baggage pick and drop administration to every one of the travelers — IRCTC plans to present a large group of new benefits in the new Tejas express. It will be the main train to be completely kept running by…

MakeMyTrip scouting for more acquisitions after Ibibo

Mumbai: MakeMyTrip Ltd will look to acquire technology-oriented hotel solution providers, reduce discounts and offers and focus on sustainable long-term growth, the online travel firm’s chief executive said. The Nasdaq-listed company acquired rival online travel agent Goibibo in October. Deep Kalra, founder and CEO of MakeMyTrip said the 90-day integration with Goibibo, which started in January,…

Ibibo, Online Travel Company raises $250 Million from Naspers

Ibibo Group, India based online travel company has raised $250 million from existing investor Naspers. The raised funding will be used in Ibibo’s hotel vertical and technology. Ibibo, has been one of the most sought-after online travel companies in India. According to the data provided by the company, it did 6.5 million transactions in the last quarter of 2015, as a result, over 1.6 million hotel…

In this blog post, I'll write about a clickjacking vulnerability discovered by me. Introduction ibibo.com is a social networking and gaming website, currently one of the largest "Indian" social networking website. At the time of writing its Alexa Rank was 1,198 globally and 121 in India. On 19th June 2012, while browsing to the website, I noticed that the site does not use the X-FRAME-OPTIONS header to prevent framing of important pages which can be used to click-jack users of  ibibo.com to perform different kinds of action on behalf of them. Now let's talk something about click-jacking. What is Clickjacking  Taken from Wikipedia's Clickjacking Page: Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different to what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages. It is a browser security issue that is a vulnerability across a variety of browsers and platforms, a clickjack takes the form of embedded code or a script that can execute without the user's knowledge, such as clicking on a button that appears to perform another function. The term "clickjacking" was coined by Jeremiah Grossman and Robert Hansen in 2008. ibibo.com Allows Framing As mentioned above ibibo.com allows framing of its pages without any restriction, this can easily facilitate in clickjacking attacks. Below there are two screenshots showing the framed ibibo.com's dashboard page that I will later use in the video to demonstrate a working exploit which will update the status of an ibibo.com user.

ibibo.com's dashboard page framed with frame opacity set to 0.5

ibibo.com's dashboard page framed with frame opacity set to 0

Video Demo

In the video below, it can be seen clearly a user plays a specially crafted game, which is in fact the clickjacking page. After completing the game, when he tries to check the score nothing happens but in the background his ibibo account automatically gets updated using the clickjacking exploit. 

If the account was linked to Facebook and Twitter they will also be updated automatically. (I've not tested though)

Prevention

Prevention can be only done by ibibo.com by restricting framing of crucial pages by X-FRAME-OPTIONS  HTTP header on Server Side.

For general users a temporary solution can be made by using the NoScript Firefox Add-on. which provides built-in support for clickjacking/likejacking attacks.

As a general security advice, people should not follow suspicious links or click on pages that look fishy, specially when sent or given by an unknown user/mailer.

Thanks for reading, have a good day