Feeds

Trial finds EIGHT WAYS to defeat Google, PayPal and other SSOs

Multiple flaws in web service single sign-on

The Essential Guide to IT Transformation

US security researchers have unearthed flaws in the single sign-on (SSO) services operated by a number of portals, including Google and PayPal.

Idiosyncratic methods of integrating the APIs, SDKs and sample code supplied by identity providers are creating exploitable security shortcomings, according to a study by two researchers at Indiana University and one Microsoft researcher. In particular, the researchers said, the process of token exchange is often mangled, which creates the possibility for attackers to sign into targeted accounts without having to crack an intended victim's password.

The study (PDF) – touted as the first field trial of popular web SSO systems – focused on implementation problems rather than fundamental flaws in the cryptographic techniques at play, which are fundamentally fine.

The exercise uncovered eight serious logic flaws in high-profile ID providers and relying party websites (which rely on authentication cookies to establish a user session). ID providers affected included OpenID (including Google ID and PayPal Access); Facebook; the JanRain platform; Freelancer; FarmVille; and Sears.com. Every one of the eight flaws allows an attacker to sign in as a targeted user.

The researchers – Shuo Chen of Microsoft Research and Rui Wang and XiaoFeng Wang, both of Indiana University, Bloomington – have contacted the sites involved, which have largely deployed a fix.

In a statement, the Open ID Foundation said it was investigating whether other less high profile websites suffered from similar security shortcomings and said it was working with these ID providers to help them get patched up.

OpenID Foundation board members have worked to identify other websites that were impacted and similarly have them deploy a fix. There are no known examples of attacks using this technique. If your website does not use an OpenID RP implementation from one of the OpenID Foundation vendors, we suggest reading the report.

OpenID and other web-based single sign-on schemes offer the promise of reducing password headaches by allowing a user who is already signed in to Google, for example, to sign into other websites. This involves exchanging identity information (tokens), a process that is often badly applied in commercial systems, as the researchers conclude.

The study shows that security-critical logic flaws pervasively exist in these systems, which can be discovered from browser-relayed messages and practically exploited by a party without access to source code or other insider knowledge of these systems.

The Microsoft/Indiana team warn that they are only scratching the surface of a problem that needs wider community support to address. To push this effort the researchers are establishing a site – http://sso-analysis.org – that will allow developers and security analysts to run checks on SSO implementations.

The researchers are due to present a paper on their research at the upcoming IEEE Symposium on Security and Privacy, which takes place between 20 and 23 May in San Francisco. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.