Feeds

Hey, you know Android apps can 'access ALL' of your Google account?

One-click login hands over keys to Gmail, Google Drive et al, says researcher

Choosing a cloud hosting partner with confidence

The single-click Google account login for Android apps is a little too convenient for hackers, according to Tripwire's Craig Young, who has demonstrated a flaw in the authentication method.

The mechanism is called “weblogin”, and basically it allows users to use their Google account credentials as authentication for third-party apps, without sharing the username and password itself: a token is generated to represent the user's login details.

Young claimed the unique token used by Google's weblogin system can be harvested by a rogue app and then used to access all of the advertising's giants services as that user.

To demonstrate the flaw at this month's Def Con 21 hacking conference in Las Vegas, Young created an Android app that asks for access to the user's Google account to display stocks from Google Finance.

Assuming the user grants permission the app, it issues a token to access the requested data. The rogue app sends that token back to the hacker, who can paste it into a web session to access all of the user's Google services, said Young.

That includes unrestricted access to Gmail, Google Drive, Google Calendar and so forth, even though the permission was only given for an Android app to access Google Finance, we're told.

Users do have to give multiple permissions to the app first: to access local accounts; to access the network; and to kick off a web session accessing finance.google.com - the last bit being when the web-usable token is issued. But if the user is expecting integration with Google Finance, then none of that would surprise them.

Handing over the keys to their Google Drive files would, however.

Once the miscreant has a valid token then they could see their mark's search history, among other things. Young points out that should our victim happen to be a Google Administrator then the attacker could take control of the administered accounts, changing passwords, modifying privileges, etc.

But they'll have to move fast - Google's automated scanning may not have noticed the app's behaviour (his rogue app was only removed from the Google Play app store following a complaint despite being clearly marked as a security test) but since being informed about the vuln in February the Chocolate Factory has been working to close the security hole. (The the PC World blog has more details on the bloke's research.)

The flaw is typical of what happens when simplicity overtakes security in developers' order of priorities. It's unlikely that anyone but the most-dedicated spear-phisher would take advantage of a flaw like this, but its exposure reminds us to be aware of the permissions we grant – and keeps Google et al fixing flaws which shouldn't exist in the first place. ®

Beginner's guide to SSL certificates

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.