Feeds

Trial finds EIGHT WAYS to defeat Google, PayPal and other SSOs

Multiple flaws in web service single sign-on

Beginner's guide to SSL certificates

US security researchers have unearthed flaws in the single sign-on (SSO) services operated by a number of portals, including Google and PayPal.

Idiosyncratic methods of integrating the APIs, SDKs and sample code supplied by identity providers are creating exploitable security shortcomings, according to a study by two researchers at Indiana University and one Microsoft researcher. In particular, the researchers said, the process of token exchange is often mangled, which creates the possibility for attackers to sign into targeted accounts without having to crack an intended victim's password.

The study (PDF) – touted as the first field trial of popular web SSO systems – focused on implementation problems rather than fundamental flaws in the cryptographic techniques at play, which are fundamentally fine.

The exercise uncovered eight serious logic flaws in high-profile ID providers and relying party websites (which rely on authentication cookies to establish a user session). ID providers affected included OpenID (including Google ID and PayPal Access); Facebook; the JanRain platform; Freelancer; FarmVille; and Sears.com. Every one of the eight flaws allows an attacker to sign in as a targeted user.

The researchers – Shuo Chen of Microsoft Research and Rui Wang and XiaoFeng Wang, both of Indiana University, Bloomington – have contacted the sites involved, which have largely deployed a fix.

In a statement, the Open ID Foundation said it was investigating whether other less high profile websites suffered from similar security shortcomings and said it was working with these ID providers to help them get patched up.

OpenID Foundation board members have worked to identify other websites that were impacted and similarly have them deploy a fix. There are no known examples of attacks using this technique. If your website does not use an OpenID RP implementation from one of the OpenID Foundation vendors, we suggest reading the report.

OpenID and other web-based single sign-on schemes offer the promise of reducing password headaches by allowing a user who is already signed in to Google, for example, to sign into other websites. This involves exchanging identity information (tokens), a process that is often badly applied in commercial systems, as the researchers conclude.

The study shows that security-critical logic flaws pervasively exist in these systems, which can be discovered from browser-relayed messages and practically exploited by a party without access to source code or other insider knowledge of these systems.

The Microsoft/Indiana team warn that they are only scratching the surface of a problem that needs wider community support to address. To push this effort the researchers are establishing a site – http://sso-analysis.org – that will allow developers and security analysts to run checks on SSO implementations.

The researchers are due to present a paper on their research at the upcoming IEEE Symposium on Security and Privacy, which takes place between 20 and 23 May in San Francisco. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.