1

According to forbes , Using the single sign-on via social account to login some applications can allow an attacker to hijack the user account's

the flaws can be exploited remotely by an attacker to sign into a victim’s mobile app account without any awareness of the victim.

The researchers said that over than 2.4 Billion downloads that are vulnerable to this issue.

What is the impact of the OAuth 2 flaw on my social account and on my connected devices?

2

This is an fact not a flaw in OAuth 2 but in the implicit trust some developers have put into the data supplied by an Identity Provider (IDp).

The attack mentioned in the Original research is based on manipulating data intransit between 2 apps on your device or between a client and a server (either the Oauth Provider or a 3rd party service).

It boils down to a failure to recognize that you simply can not trust an end-user device (or any device outside of your control) so app developers should treat the data as 'evil' (as all user input should be treated) and assume it will be tampered with.

the attack leverages this mistake by supplying a correct access token but incorrect user details (such as using my own access token and your email address) which than will travel down to the 3rd party server and will be used as means of identifying me (so I will in fact be Identified as you as your email was supplied). In order for me to do this all I would need is your email address (easy to obtain). These servers should have been programmed in a different way. namely they should retrieve there own state of the user details utilizing the access token retrieved by the app. and validate that these are the same as provided.

Now how does this all translate to your question of impact on your devices. I am afraid the awnser is and will almost certainly always be "we do not know" Since the flow is a misunderstanding of the protocols use and risks. Since there are to many Apps we simply can not test them all if threre vulnerable for this abuse all. Since the exploit does not require anything from the victim but 'public' data you could be at risk without using oauth 2 logins at all. This is something the developers of these apps and services need to fix. and all wecan do is ask them to prove there not vulnerable (a.e. ask them to do a pen-test)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.