Perimeter
2/20/2013
09:04 PM
Larry Seltzer
Larry Seltzer
Commentary
Connect Directly
Twitter
Facebook
Google+
LinkedIn
RSS
E-Mail
50%
50%

The Road To Hell Is Authenticated By Facebook

OAuth allows us to log into many sites using familiar credentials, from Twitter, Facebook, Google or Microsoft. The main author of the original OAuth 1.0 spec says these giants took it and made OAuth 2.0 a monstrous, complex, and insecure mess that has already brought us significant vulnerabilities

Egor Homakov hacked Facebook the other day, and while that's interesting all on its own, it's much more interesting as the advance guard of what will surely be a busy season of attacks against sites authenticating with OAuth 2.0.

The hack, which also employs a Chrome bug, allows Homakov to obtain authentication credentials for any client_id the user previously authorized on Facebook. Homakov says:

Currently I'm discussing and proposing new ways to Facebook security team how to handle it and make response_type=code more secure, because they are the biggest provider and their decisions matter. If we don't fix it - it's The Road To Hell!
His "Road To Hell!" reference doesn't come out of nowhere. It's a reference to the resignation of Eran Hammer, lead OAuth2 project author, from the project. Hammer entitled that resignation "OAuth 2.0 and the Road to Hell."

The OAuth site describes it as "[A]n open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications." It's a method of access delegation, allowing a third party to perform authentication for you. When you go to log into a site and get the option to use your Google or Yahoo or Facebook login instead, that's OAuth in action.

Hammer had been the coordinator of the OAuth 1.0 spec and recognized its limitations:

  • It relied on digital signatures, which were poorly implemented and a pain to use.
  • It was designed to work on the lowest-common denominator hosting and insecure transports.
  • Many OAuth libraries are "broken" (i.e., they don't work well).
  • Many vendors wrote their own proprietary extensions, impeding standard operation. Hammer is particularly bothered by Yahoo's session extension (more later).

Because OAuth didn't do what they wanted it to do — it doesn't scale to large, high-volume systems — Yahoo, Microsoft, and Google came up with WRAP (Web Resource Authorization Protocol). Later they deprecated it in favor of OAuth 2.0.

The limitations of OAuth 1.0 were clear to everyone involved, so in 2009 a working group was founded to create OAuth 2.0. But by this point, as Hammer sees it, the establishment took over and turned a sloppy but useful system into a monstrous, complex, and frighteningly insecure one.

Microsoft, Google, Yahoo (MGY), and perhaps some other big sites bent the OAuth standardization process, which was moved into the IETF, to their needs: It's designed for large, hosted sites. It's not designed to work well with mobile clients (remember, this all happened before mobile's centrality was obvious). MGY dominated the standards process, and nobody else showed up to defend other interests.

Of course OAuth 2 claims to be secure, but Hammer says it's all security theater. The main failure comes from the abandonment of digitally signed tokens and uses unsigned "bearer tokens," relying on SSL for security. This excessive faith in SSL leaves the system open to severe attacks that sound suspiciously like the one Homakov reported. The result of these attacks can be theft of credentials, URL hijacking, and malware installation.

The original imperative of OAuth was to be simple and accessible, but MGY came up with a complex, stateful protocol that also manages to be incompatible with OAuth 1.0. WRAP, and now OAuth 2, essentially bakes the Yahoo Session Extension into the spec, so a generic client has to implement it even if some sites don't require it. It also manages to degrade user experience by forcing users to refresh tokens periodically. The lack of backward-compatibility isn't a secret; the spec announces it to the world:

1.8. Interoperability

OAuth 2.0 provides a rich authorization framework with well-defined security properties. However, as a rich and highly extensible framework with many optional components, on its own this specification is likely to produce a wide range of noninteroperable implementations.

In addition, this specification leaves a few required components partially or fully undefined (e.g., client registration, authorization server capabilities, endpoint discovery). Without these components, clients must be manually and specifically configured against a specific authorization server and resource server in order to interoperate.

This framework was designed with the clear expectation that future work will define prescriptive profiles and extensions necessary to achieve full Web-scale interoperability.

As you can see in the embedded video above, Hammer has a really bad attitude. He's mad after his OAuth experience and, to the extent that he wants to be part of the solution now, that solution is purely consumer-oriented and tells the enterprise to take all of its interests and use cases and &%*&( %^^^$ *@##@. His new project in this space is OZ.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Follow Larry Seltzer and BYTE on Twitter, Facebook, LinkedIn, and Google+: - @lseltzer @BYTE - Larry Seltzer BYTE - Larry Seltzer on LinkedIn BYTE - Larry Seltzer on Google+ View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.