Is OAuth Really Secure?

•

Dec. 17, 2010

• •

IBWAS’10

Bruno Pedro
17 November 2010

Is OAuth
Really
Secure?

http://www.ﬂickr.com/photos/rooreynol...

Bruno Pedro
A n e x p e r i e n c e d We b d e v e l o p e r a n d
entrepreneur. Co-founder of tarpipe.com, a
social media...

Summary

• What is OAuth?
• Possible OWASP Top 10 threats
• Possible solutions
• Questions

Next SlideShares

Upcoming SlideShare

Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...

Shiny, Let’s Be Bad Guys: Exploiting and Mitigating the Top 10 Web App Vulner...

Loading in …3

×

Is OAuth Really Secure?

Dec. 17, 2010

• •

Download to read offline

Slides from a talk I gave at IBWAS'10 in Lisbon, Portugal.

Abstract:
Is the OAuth protocol really secure? Even though the OAuth authorization protocol has been published as the RFC 5849 and is being widely adopted by large Internet companies, it's important to stress out its possible security vulnerabilities.
This talk will focus on the OWASP Top 10 Application Security Risks and how OAuth is affected by them.

While some of the security risks are mitigated by OAuth, developers need to take some action to prevent other risks from affecting their implementations.

Slides from a talk I gave at IBWAS'10 in Lisbon, Portugal.

Abstract:
Is the OAuth protocol really secure? Even though the OAuth authorization protocol has been published as the RFC 5849 and is being widely adopted by large Internet companies, it's important to stress out its possible security vulnerabilities.
This talk will focus on the OWASP Top 10 Application Security Risks and how OAuth is affected by them.

While some of the security risks are mitigated by OAuth, developers need to take some action to prevent other risks from affecting their implementations.

More Related Content

So You Want to Start a Podcast: Finding Your Voice, Telling Your Story, and Building a Community That Will Listen Kristen Meinzer

SAM: One Robot, a Dozen Engineers, and the Race to Revolutionize the Way We Build Jonathan Waldman

From Gutenberg to Google: The History of Our Future Tom Wheeler

Talk to Me: How Voice Computing Will Transform the Way We Live, Work, and Think James Vlahos

The Future Is Faster Than You Think: How Converging Technologies Are Transforming Business, Industries, and Our Lives Peter H. Diamandis

Autonomy: The Quest to Build the Driverless Car—And How It Will Reshape Our World Lawrence D. Burns

No Filter: The Inside Story of Instagram Sarah Frier

Bezonomics: How Amazon Is Changing Our Lives and What the World's Best Companies Are Learning from It Brian Dumaine

Live Work Work Work Die: A Journey into the Savage Heart of Silicon Valley Corey Pein

Future Presence: How Virtual Reality Is Changing Human Connection, Intimacy, and the Limits of Ordinary Life Peter Rubin

Life After Google: The Fall of Big Data and the Rise of the Blockchain Economy George Gilder

Everybody Lies: Big Data, New Data, and What the Internet Can Tell Us About Who We Really Are Seth Stephens-Davidowitz

Understanding Media: The Extensions of Man Marshall McLuhan

The Art of War Sun Tsu

The Victorian Internet: The Remarkable Story of the Telegraph and the Nineteenth Century's On-line Pioneers Tom Standage

Uncommon Carriers John McPhee

The Quiet Zone: Unraveling the Mystery of a Town Suspended in Silence Stephen Kurczy

System Error: Where Big Tech Went Wrong and How We Can Reboot Rob Reich

The Wires of War: Technology and the Global Struggle for Power Jacob Helberg

After Steve: How Apple Became a Trillion-Dollar Company and Lost its Soul Tripp Mickle

Einstein's Fridge: How the Difference Between Hot and Cold Explains the Universe Paul Sen

Dignity in a Digital Age: Making Tech Work for All of Us Ro Khanna

Test Gods: Virgin Galactic and the Making of a Modern Astronaut Nicholas Schmidle

Driven: The Race to Create the Autonomous Car Alex Davies

Second Nature: Scenes from a World Remade Nathaniel Rich

Spooked: The Trump Dossier, Black Cube, and the Rise of Private Spies Barry Meier

A World Without Work: Technology, Automation, and How We Should Respond Daniel Susskind

Lean Out: The Truth About Women, Power, and the Workplace Marissa Orr

Uncanny Valley: A Memoir Anna Wiener

Blockchain: The Next Everything Stephen P. Williams

User Friendly: How the Hidden Rules of Design Are Changing the Way We Live, Work, and Play Cliff Kuang

The Players Ball: A Genius, a Con Man, and the Secret History of the Internet's Rise David Kushner

Is OAuth Really Secure?

1. IBWAS’10 Bruno Pedro 17 November 2010 Is OAuth Really Secure? http://www.ﬂickr.com/photos/rooreynolds/2396418896/
2. Bruno Pedro A n e x p e r i e n c e d We b d e v e l o p e r a n d entrepreneur. Co-founder of tarpipe.com, a social media publishing platform. http://tarpipe.com/user/bpedro
3. Summary • What is OAuth? • Possible OWASP Top 10 threats • Possible solutions • Questions
4. What is OAuth? 1. Authorization protocol (RFC 5849)
5. What is OAuth? 2. Built on top of Google AuthSub, Flickr Auth and others http://tinyurl.com/3yhys4n
6. What is OAuth? 3. Authentication solution
7. What is OAuth? 4. Available for Web, desktop and also mobile and device applications
8. A1 - Injection ask for token consumer provider receive token
9. A1 - Injection ask for token mer provider ve rif yt receive token ok en database potential injection
10. A3 - Broken authentication consumer API call provider access token access secret • Weak or open access token and secret • Possible user impersonation
11. A5 - CSRF http://tinyurl.com/38o3r93 • End point might be open to CSRF • Possible user impersonation
12. A7 - Insecure Cryptographic Storage consumer tokens provider database database
13. A7 - Insecure Cryptographic Storage access to access to mer consumer all consumers prov users and all users database database
14. A10 - Unvalidated redirects • After authorizing, user is redirected to a callback URL • Callback might be an arbitrary value
15. Probably safe A2 — Cross Site Scripting A4 — Insecure Direct Object Reference A6 — Security Misconﬁguration A8 — Failure to Restrict URL Access A9 — Insuﬁcient Transport Layer Protection
16. Pay attention to A1 — Injection A3 — Broken Authentication A5 — Cross Site Request Forgery A7 — Insecure Cryptographic Storage A10 — Unvalidated Redirects
17. Possible solutions • Encrypt all OAuth credentials mitigates A3 and A7
18. Possible solutions • Generate veriﬁable consumer keys mitigates A1
19. Possible solutions • Throttle undesired usage mitigates A1 and A3
20. More information • OAuth: http://oauth.net • OWASP: http://owasp.org • OAuth Checklist: http://oauthchecklist.org
21. Questions? Thank you!

Editor's Notes

\n

\n

\n

RFC only published in April 2010\n

Authorization - used most of the time\nAuthentication - 2 legged OAuth, &#x201C;sign in with twitter&#x201D;, no to be confused with OpenID\nBuilt as an Open Protocol on top of already existing solutions (Amazon,Yahoo)\n

Authorization - used most of the time\nAuthentication - 2 legged OAuth, &#x201C;sign in with twitter&#x201D;, no to be confused with OpenID\nBuilt as an Open Protocol on top of already existing solutions (Amazon,Yahoo)\n

\n

\n

Possible solution: verify tokens prior to database\n

Possible solutions: crypto, throttle\n

Possible solution: any CSRF solution\n

\n

Solution: crypto and more\n

Possible solution: fix callback to same domain or even same page\n

\n

\n

A3 - Broken authentication, A7 - Insecure cryptographic storage\n

A1 - Injection\n

A1 - Injection, A3 - Broken authentication\n

\n

\n