Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

2/20/2013
09:04 PM
Larry Seltzer
Larry Seltzer
Commentary
Connect Directly
Twitter
Facebook
Google+
LinkedIn
RSS
E-Mail
50%
50%

The Road To Hell Is Authenticated By Facebook

OAuth allows us to log into many sites using familiar credentials, from Twitter, Facebook, Google or Microsoft. The main author of the original OAuth 1.0 spec says these giants took it and made OAuth 2.0 a monstrous, complex, and insecure mess that has already brought us significant vulnerabilities

Egor Homakov hacked Facebook the other day, and while that's interesting all on its own, it's much more interesting as the advance guard of what will surely be a busy season of attacks against sites authenticating with OAuth 2.0.

The hack, which also employs a Chrome bug, allows Homakov to obtain authentication credentials for any client_id the user previously authorized on Facebook. Homakov says:

Currently I'm discussing and proposing new ways to Facebook security team how to handle it and make response_type=code more secure, because they are the biggest provider and their decisions matter. If we don't fix it - it's The Road To Hell!
His "Road To Hell!" reference doesn't come out of nowhere. It's a reference to the resignation of Eran Hammer, lead OAuth2 project author, from the project. Hammer entitled that resignation "OAuth 2.0 and the Road to Hell."

The OAuth site describes it as "[A]n open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications." It's a method of access delegation, allowing a third party to perform authentication for you. When you go to log into a site and get the option to use your Google or Yahoo or Facebook login instead, that's OAuth in action.

Hammer had been the coordinator of the OAuth 1.0 spec and recognized its limitations:

  • It relied on digital signatures, which were poorly implemented and a pain to use.
  • It was designed to work on the lowest-common denominator hosting and insecure transports.
  • Many OAuth libraries are "broken" (i.e., they don't work well).
  • Many vendors wrote their own proprietary extensions, impeding standard operation. Hammer is particularly bothered by Yahoo's session extension (more later).

Because OAuth didn't do what they wanted it to do — it doesn't scale to large, high-volume systems — Yahoo, Microsoft, and Google came up with WRAP (Web Resource Authorization Protocol). Later they deprecated it in favor of OAuth 2.0.

The limitations of OAuth 1.0 were clear to everyone involved, so in 2009 a working group was founded to create OAuth 2.0. But by this point, as Hammer sees it, the establishment took over and turned a sloppy but useful system into a monstrous, complex, and frighteningly insecure one.

Microsoft, Google, Yahoo (MGY), and perhaps some other big sites bent the OAuth standardization process, which was moved into the IETF, to their needs: It's designed for large, hosted sites. It's not designed to work well with mobile clients (remember, this all happened before mobile's centrality was obvious). MGY dominated the standards process, and nobody else showed up to defend other interests.

Of course OAuth 2 claims to be secure, but Hammer says it's all security theater. The main failure comes from the abandonment of digitally signed tokens and uses unsigned "bearer tokens," relying on SSL for security. This excessive faith in SSL leaves the system open to severe attacks that sound suspiciously like the one Homakov reported. The result of these attacks can be theft of credentials, URL hijacking, and malware installation.

The original imperative of OAuth was to be simple and accessible, but MGY came up with a complex, stateful protocol that also manages to be incompatible with OAuth 1.0. WRAP, and now OAuth 2, essentially bakes the Yahoo Session Extension into the spec, so a generic client has to implement it even if some sites don't require it. It also manages to degrade user experience by forcing users to refresh tokens periodically. The lack of backward-compatibility isn't a secret; the spec announces it to the world:

1.8. Interoperability

OAuth 2.0 provides a rich authorization framework with well-defined security properties. However, as a rich and highly extensible framework with many optional components, on its own this specification is likely to produce a wide range of noninteroperable implementations.

In addition, this specification leaves a few required components partially or fully undefined (e.g., client registration, authorization server capabilities, endpoint discovery). Without these components, clients must be manually and specifically configured against a specific authorization server and resource server in order to interoperate.

This framework was designed with the clear expectation that future work will define prescriptive profiles and extensions necessary to achieve full Web-scale interoperability.

As you can see in the embedded video above, Hammer has a really bad attitude. He's mad after his OAuth experience and, to the extent that he wants to be part of the solution now, that solution is purely consumer-oriented and tells the enterprise to take all of its interests and use cases and &%*&( %^^^$ *@##@. His new project in this space is OZ.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Follow Larry Seltzer and BYTE on Twitter, Facebook, LinkedIn, and Google+: - @lseltzer @BYTE - Larry Seltzer BYTE - Larry Seltzer on LinkedIn BYTE - Larry Seltzer on Google+ View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9351
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. If an unauthenticated attacker makes a POST request to /tools/developerConsoleOperations.jsp or /isomorphic/IDACall with malformed XML data in the _transaction parameter, the server replies with a verbose error showing where the application resides (the a...
CVE-2020-9352
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. Unauthenticated exploitation of blind XXE can occur in the downloadWSDL feature by sending a POST request to /tools/developerConsoleOperations.jsp with a valid payload in the _transaction parameter.
CVE-2020-9353
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) loadFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL is affected by unauthenticated Local File Inclusion via directory-traversal sequences in the elem XML ...
CVE-2020-9354
PUBLISHED: 2020-02-23
An issue was discovered in SmartClient 12.0. The Remote Procedure Call (RPC) saveFile provided by the console functionality on the /tools/developerConsoleOperations.jsp (or /isomorphic/IDACall) URL allows an unauthenticated attacker to overwrite files via vectors involving an XML comment and /.. pat...
CVE-2020-9355
PUBLISHED: 2020-02-23
danfruehauf NetworkManager-ssh before 1.2.11 allows privilege escalation because extra options are mishandled.