BlackHat资料us-14-Hu-How-To-Leak-A100-Million-Node-Social-Graph-In-Just-One-Week.pdfVIP

OAuth App Impersonation Attack HOW TO LEAK A 100-MILLION-NODE SOCIAL GRAPH IN JUST ONE WEEK? - A REFLECTION ON OAUTH AND API DESIGN IN ONLINE SOCIAL NETWORKS Pili Hu Wing Cheong Lau The Chinese University of Hong Kong Aug, 2014 BlackHat’14 Outline ● OAuth Background ● Previous Attacks Based on Misuse ● App Impersonation Attack ○ Forged-implicit-flow Attack ○ Forged-bearer-token Attack ○ Executive Summary ● Case Study ○ Massive leakage of user data ○ Other sample exploits ● Immediate Fixes ● Reflections OAuth Background Three System Participants ● Providers …... ● User ○ Register user account on Provider ○ Operate various data objects ● App ○ Register developer account on Provider ○ Get data objects access permission from ■ Provider: via application/ approval ■ User: via OAuth ○ AppID, AppSecret OAuth Standardization Landscape ● OAuth 1.0: ○ RFC5849, April 2010 ○ Obsoleted by OAuth 2.0. ○ Only a few Provider, e.g. Twitter ● OAuth 2.0: ○ Framework specification: RFC6749, Oct 2012 ○ Security analysis: RFC6819, Jan 2013 ○ Token types: ■ Bearer token: RFC6750 ■ MAC token: E. Hammer-Lahav, draft-5 (Jan 2014) ○ Widely supported by Providers with different implementations OAuth Background Authorization Code Grant Authorization Code Grant Flow OAuth Background Implicit Grant Implicit Grant Flow Previous Attacks on OAuth ● Session fixation ● Covert redirect All based on misuse and other weak parts in Provider/App. General wisdom: Secure if all