Perimeter
2/20/2013
09:04 PM
Larry Seltzer
Larry Seltzer
Commentary
Connect Directly
Facebook
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

The Road To Hell Is Authenticated By Facebook

OAuth allows us to log into many sites using familiar credentials, from Twitter, Facebook, Google or Microsoft. The main author of the original OAuth 1.0 spec says these giants took it and made OAuth 2.0 a monstrous, complex, and insecure mess that has already brought us significant vulnerabilities

Egor Homakov hacked Facebook the other day, and while that's interesting all on its own, it's much more interesting as the advance guard of what will surely be a busy season of attacks against sites authenticating with OAuth 2.0.

The hack, which also employs a Chrome bug, allows Homakov to obtain authentication credentials for any client_id the user previously authorized on Facebook. Homakov says:

Currently I'm discussing and proposing new ways to Facebook security team how to handle it and make response_type=code more secure, because they are the biggest provider and their decisions matter. If we don't fix it - it's The Road To Hell!
His "Road To Hell!" reference doesn't come out of nowhere. It's a reference to the resignation of Eran Hammer, lead OAuth2 project author, from the project. Hammer entitled that resignation "OAuth 2.0 and the Road to Hell."

The OAuth site describes it as "[A]n open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications." It's a method of access delegation, allowing a third party to perform authentication for you. When you go to log into a site and get the option to use your Google or Yahoo or Facebook login instead, that's OAuth in action.

Hammer had been the coordinator of the OAuth 1.0 spec and recognized its limitations:

  • It relied on digital signatures, which were poorly implemented and a pain to use.
  • It was designed to work on the lowest-common denominator hosting and insecure transports.
  • Many OAuth libraries are "broken" (i.e., they don't work well).
  • Many vendors wrote their own proprietary extensions, impeding standard operation. Hammer is particularly bothered by Yahoo's session extension (more later).

Because OAuth didn't do what they wanted it to do — it doesn't scale to large, high-volume systems — Yahoo, Microsoft, and Google came up with WRAP (Web Resource Authorization Protocol). Later they deprecated it in favor of OAuth 2.0.

The limitations of OAuth 1.0 were clear to everyone involved, so in 2009 a working group was founded to create OAuth 2.0. But by this point, as Hammer sees it, the establishment took over and turned a sloppy but useful system into a monstrous, complex, and frighteningly insecure one.

Microsoft, Google, Yahoo (MGY), and perhaps some other big sites bent the OAuth standardization process, which was moved into the IETF, to their needs: It's designed for large, hosted sites. It's not designed to work well with mobile clients (remember, this all happened before mobile's centrality was obvious). MGY dominated the standards process, and nobody else showed up to defend other interests.

Of course OAuth 2 claims to be secure, but Hammer says it's all security theater. The main failure comes from the abandonment of digitally signed tokens and uses unsigned "bearer tokens," relying on SSL for security. This excessive faith in SSL leaves the system open to severe attacks that sound suspiciously like the one Homakov reported. The result of these attacks can be theft of credentials, URL hijacking, and malware installation.

The original imperative of OAuth was to be simple and accessible, but MGY came up with a complex, stateful protocol that also manages to be incompatible with OAuth 1.0. WRAP, and now OAuth 2, essentially bakes the Yahoo Session Extension into the spec, so a generic client has to implement it even if some sites don't require it. It also manages to degrade user experience by forcing users to refresh tokens periodically. The lack of backward-compatibility isn't a secret; the spec announces it to the world:

1.8. Interoperability

OAuth 2.0 provides a rich authorization framework with well-defined security properties. However, as a rich and highly extensible framework with many optional components, on its own this specification is likely to produce a wide range of noninteroperable implementations.

In addition, this specification leaves a few required components partially or fully undefined (e.g., client registration, authorization server capabilities, endpoint discovery). Without these components, clients must be manually and specifically configured against a specific authorization server and resource server in order to interoperate.

This framework was designed with the clear expectation that future work will define prescriptive profiles and extensions necessary to achieve full Web-scale interoperability.

As you can see in the embedded video above, Hammer has a really bad attitude. He's mad after his OAuth experience and, to the extent that he wants to be part of the solution now, that solution is purely consumer-oriented and tells the enterprise to take all of its interests and use cases and &%*&( %^^^$ *@##@. His new project in this space is OZ.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Follow Larry Seltzer and BYTE on Twitter, Facebook, LinkedIn, and Google+: - @lseltzer @BYTE - Larry Seltzer BYTE - Larry Seltzer on LinkedIn BYTE - Larry Seltzer on Google+ View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-0188
Published: 2014-04-24
The openshift-origin-broker in Red Hat OpenShift Enterprise 2.0.5, 1.2.7, and earlier does not properly handle authentication requests from the remote-user auth plugin, which allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to...

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Best of the Web