○

○○Resource Owner/End User

Service Provider

Relying PartyA process for end-users to grant a third-party website accessto their private resources stored on a service provider.

ResourceOwner

Relying Party?

Service ProviderA process for end-users to grant a third-party website accessto their private resources stored on a service provider.

ResourceOwner

Relying Party?

Service Provider

○
○
○○

○
○
○○

Register your application on the service provider

Service Provider

UserVerifies signature

Relying Party

1. [App ID, Resource_type ]2. Req Token●●‘[]’ means signed withapp secretResource_type canbe: email, user’sphotos, etc

Service Provider

UserVerifies signature

Relying Party

1. [App ID, Resource_type ]2. Req Token

3. Req Token + Redirect URI, Redirect User to gain permissions

Service Provider

UserVerifies signature

Relying Party

1. [App ID, Resource_type ]2. Req Token

3. Req Token + Redirect URI, Redirect User to gain permissions

Service Provider

UserVerifies signature

Relying Party

1. [App ID, Resource_type ]2. Req Token

3. Req Token + Redirect URI, Redirect User to gain permissions

4. Req Token, Redirect User back to relying partyVerifies signature

5. [Req Token]6. Access Token

Verifies signature

7. [Access Token]8. Protected resource: email, contact, etc

Service Provider

UserVerifies signature

Relying Party’s web server

1. [App ID, Resource_type ]2. Req Token

3. Req Token + Redirect URI, Redirect User to gain permissions

4. Req Token, Redirect User back to relying partyVerifies signature

5. [Req Token]6. Access Token

Verifies signature

7. [Access Token]*8. Protected resource: email, contact, etc* The secret is only knownbetween the relying partyand service provider

Service Provider

UserVerifies signature

Relying Party’s mobile client

1. [App ID, Resource_type ]2. Req Token

3. Req Token + Redirect URI, Redirect User to gain permissions

4. Req Token, Redirect User back to relying partyVerifies signature

5. [Req Token]6. Access Token

Verifies signature

7. [Access Token]*8. Protected resource: email, contact, etc

Many applications decideto bundle this secret intotheir mobile apps.

src/com/pinterest/activity/signin/TwitterAuthActivity.java26:return (new ServiceBuilder()).
provider(org/scribe/builder/api/TwitterApi).
apiKey("Zr6TVkMT2KhKIZwERTB8IQ").
apiSecret("WYmVb7f0a************************X83gNCGQ0").
callback("oauth://twitter").
build();

● After we notified Quora and Pinterest in2014○ Both Quora and Pinterest revoked theirexisting relying party secrets.
○ Quora’s twitter authentication wasnon-functional after our report.
● Both are not using twitter loginanymore...

○Service Provider

UserVerifies signature

Relying Party

1. [App ID, Resource_type ]2. Req Token

3. Req Token + Redirect URI, Redirect User to gain permissions

4. Req Token + Verifier , Redirect User back to relying partyVerifies signature,5. [Req Token, Verifier]Verifier6. Access TokenVerifies signature

7. [Access Token]*8. Protected resource

OAuth 1.0a

Verifier is only sent to theregistered redirect URL

Service Provider

UserVerifies signature

Relying Party

1. [App ID, Resource_type ]2. Req Token

3. Req Token + callback URI, Redirect User to gain permissions

4. Req Token + Verifier , Redirect User back to relying partyVerifies signature,5. [Req Token, Verifier]Verifier6. Access TokenVerifies signature

7. [Access Token]*8. Protected resource

Get the local secrets of abenign app to fake theloginChange the callback URI

Evernote doesn’t checkThe redirect URI○○UserService Provider

Relying Party

1. client_id, scope, redirect_uri Redirect User to gain permissions

Relying party mustsupply a “redirect URI”to receive accesstokens from the serviceprovider

Verifies redirectURI2. Access Token , Redirect User back to relying party3. Access Token4. Protected resource●●●

No relying party secret!
No signature/encryptionAccess token is notbound to a RP

User

Service Provider

Relying Party

1. client_id, scope, redirect_uri Redirect User to gain permissionsVerifiesredirect URI*

Browser redirection(HTTP 302)

2. Access Token , Redirect User back to relying party3. Access Token4. Protected resource*The receiver of the accesstoken must be the same asthe registered redirect URI

User’s device

The “intent” URI- scheme isregistered by the receivingrelying party application

intent://token

Access token

spotify server

Access token

Facebook serverUser’s deviceThe attacker can registerand overwrite the callbackfor the “intent” scheme

intent://tokenAccess tokenAccess token

attacker server

spotify server

Facebook server○○

relying_party = Activity.getCallingPackage();dev_key_hash = getPackageManager().
getPackageInfo(relying_party, PackageManager.GET_SIGNATURES);

AuthenticationA process for a user to prove his or her identity to a relyingparty, utilizing his or her existing session with the serviceprovider.

Service Provider

ResourceOwner?

Relying Party

AuthenticationA process for a user to prove his or her identity to a relyingparty, utilizing his or her existing session with the serviceprovider.

Service Provider

ResourceOwner?

Relying Party

AuthorizationResourceOwner

Relying Party

Service Provider?

AuthenticationService Provider

ResourceOwner?

Relying Party

UserService Provider

Relying Party

1. client_id, scope, redirect_uri Redirect User to gain permissions

2. Access Token , Redirect User back to relying party3. Access Token is notbound to a relying party4. UserID

The OAuth 2.0implicit flow is notsecure forauthentication

●Smartphone

Smartphone

Bob

Bob’sAccess token

Attacker server

Attacker

AuthenticatesBob’s Accesstoken

Facebook server

AuthenticatesBob’sAccess token

Attacker’sAccess token

Bob’s Access tokenUser ID

Wish server

Facebook server<scripttype="text/javascript">window.location.href="fbconnect:\/\/success#granted_scopes=user_birthday\u00252Cuser_hometown\u00252Cuser_location\u00252Cuser_likes\u00252Cuser_friends\u00252Cemail\u00252Ccontact_email\u00252Cpublic_profile&denied_scopes=&access_token=XXXXXXXXXXX&expires_in=5182633";</script>

GET /v2.2/me?access_token=XXXXXXXXXXX&format=json&sdk=android...
{"id": "100007872092560","birthday": "11\/25\/1989","email": "yutong\u0040lockie.io","first_name": "Yutong","gender": "male","last_name": "Pei","link":"https:\/\/www.facebook.com\/app_scoped_user_id\/100007872092560\/","locale": "en_US","name": "Yutong Pei","timezone": -7,"updated_time": "2014-02-22T02:45:44+0000","verified": false}○eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vc2VydmVyLmV4YW1wbGUuY29tIiwic3ViIjoiMjQ4Mjg5NzYxMDAxIiwiYXVkIjoiczZCaGRSa3F0MyIsIm5vbmNlIjoibi0wUzZfV3pBMk1qIiwiZXhwIjoxMzExMjgxOTcwLCJpYXQiOjEzMTEyODA5NzAsImF0X2hhc2giOiI3N1FtVVB0alBmeld0RjJBbnBLOVJRIn0.VW_s1XIAkhlFTfx90VjofHjbRqM5MEtMA5mlctc7dCE{"iss": "http://server.example.com","sub": "248289761001","aud": "s6BhdRkqt3","nonce": "n-0S6_WzA2Mj","exp": 1311281970,"iat": 1311280970,"at_hash": "77QmUPtjPfzWtF2AnpK9RQ"}

User

Service Provider

Relying Party

1. client_id, scope, redirect_uri Redirect User to gain permissions

2. Authorization Code , Redirect User back to relying party3. Authorization Code + Client Credential4. Access Token5. Access Token6. Protected resource

Service side request

User

Service Provider

Relying Party

1. client_id, scope, redirect_uri Redirect User to gain permissions

2. Authorization Code , Redirect User back to relying party

The authorization codeshould be one-timepassword

3. Authorization Code + Client Credential4. Access Token5. Access Token6. Protected resource

The service provider shouldverify that the authorizationcode belongs to the samerelying party

AndroidAndroid

Bob

Bob’sAuthorizationcode

Attacker

OAuth2 codeflow

Bob’sAuthorizationcode

Bob’sAuthorizationcode

OAuth2 codeflowAttacker’sAuthorizationcode

Bob’s Authorization code

Attacker server

Sina server

Bob’s Access token

Sohu server

Sina server○○● No information about relying party for Tencentmobile UIUser’s deviceUser

App ID is public informationService Provider

MaliciousRelying party

1. App ID, redirect URI3. Access token,[App ID, User ID]

Verifiesredirect URI

2. User logsinto Tencent4. Access token,[App ID, User ID]

The user sees the same Tencentlogin-dialog for all relying parties

● No information about relying party forTencentImpact: mobile UIUser’s deviceUser~700 million users affected.
Attacker’s deviceTencent acknowledged the vulnerabilityandpatched it withina week.
Malicious

Service Provider

Relying party

1. App ID, redirect URI3. Access token,[App ID, User ID]

Verifiesredirect URI

Attacker

Service Provider

Relying party

1. App ID, redirect URI2. User logsinto Tencent4. Access token,[App ID, User ID]

3. Access token,[App ID, User ID]

Verifiesredirect URI

2. Attacker logsinto Tencent4. Access token,[App ID, User ID]

SmartphoneAttacker

Phishinglink toattacker’saccount

Bob

Login attacker’saccount

Bob will be logged intoattacker’s account

Github serverSmartphone

Attacker starts the OAuth flow on his machine:https://github.com/login/oauth/authorize?client_id=2722d7d1c25dca9b3559&redirect_uri=https://app.autocode.run&scope=user:email,public_repo

Tricks the user into rendering this iframe:<iframe src="https://app.autocode.run/?code=f3ec63e21bb4841d01f9"style="visibility:hidden;display:none"></iframe>○○○Webview provides the feature that appcan get the cookies from the webview itembedsFacebook uses long term cookie eveninside webview, and attacker can reusethe cookie to log in as the user.

○

○
○○

○

○○

{eric.chen,yuan.tian,patrick.tague}@sv.cmu,edushuochen@microsoft.comyutong@uber.com