Breaking and Fixing Mobile App Authentication with OAuth2.0-based Protocols
| Autor: | Wing Cheong Lau, Shangcheng Shi, Ronghai Yang |
|---|---|
| Rok vydání: | 2017 |
| Předmět: |
0301 basic medicine
Computer science business.industry Internet privacy Authorization Mobile apps Static program analysis Computer security computer.software_genre OpenID Connect 03 medical and health sciences 030104 developmental biology 0302 clinical medicine Identity provider 030220 oncology & carcinogenesis Android (operating system) business computer |
| Zdroj: | Applied Cryptography and Network Security ISBN: 9783319612034 ACNS |
| DOI: | 10.1007/978-3-319-61204-1_16 |
| Popis: | Although the OAuth2.0 protocol was originally designed to serve the authorization need for websites, mainstream identity providers like Google and Facebook have made significant changes on this protocol to support authentication for mobile apps. Prior research mainly focuses on how the features of mobile operating systems can affect the OAuth security. However, little has been done to analyze whether these significant modifications of the protocol call-flow can be well understood and implemented by app developers. Towards this end, we report a field-study on the Android OAuth2.0-based single-sign-on systems. In particular, we perform an in-depth static code analysis on three identity provider apps including Facebook, Google and Sina as well as their official SDKs to understand their OAuth-related transactions. We then dynamically test 600 top-ranked US and Chinese Android apps. Apart from various types of existing vulnerabilities, we also discover three previously unknown security flaws among these first-tier identity providers and a large number of popular 3rd-party apps. For example, 41% apps under study are susceptible to a newly discovered profile attack, which unlike prior works, enables remote account hijacking without any need to trick or interact with the victim. The prevalence of vulnerabilities further motivates us to propose/implement an alternative, fool-proof OAuth SDK for one of the affected IdPs to automatically prevent from these vulnerabilities. To facilitate the adoption of our proposed fixes, our solution requires minimal code changes by the 3rd-party-developers of the affected mobile apps. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|