Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

2/20/2013
09:04 PM
Larry Seltzer
Larry Seltzer
Commentary
Connect Directly
Twitter
Facebook
Google+
LinkedIn
RSS
E-Mail
50%
50%

The Road To Hell Is Authenticated By Facebook

OAuth allows us to log into many sites using familiar credentials, from Twitter, Facebook, Google or Microsoft. The main author of the original OAuth 1.0 spec says these giants took it and made OAuth 2.0 a monstrous, complex, and insecure mess that has already brought us significant vulnerabilities

Egor Homakov hacked Facebook the other day, and while that's interesting all on its own, it's much more interesting as the advance guard of what will surely be a busy season of attacks against sites authenticating with OAuth 2.0.

The hack, which also employs a Chrome bug, allows Homakov to obtain authentication credentials for any client_id the user previously authorized on Facebook. Homakov says:

Currently I'm discussing and proposing new ways to Facebook security team how to handle it and make response_type=code more secure, because they are the biggest provider and their decisions matter. If we don't fix it - it's The Road To Hell!
His "Road To Hell!" reference doesn't come out of nowhere. It's a reference to the resignation of Eran Hammer, lead OAuth2 project author, from the project. Hammer entitled that resignation "OAuth 2.0 and the Road to Hell."

The OAuth site describes it as "[A]n open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications." It's a method of access delegation, allowing a third party to perform authentication for you. When you go to log into a site and get the option to use your Google or Yahoo or Facebook login instead, that's OAuth in action.

Hammer had been the coordinator of the OAuth 1.0 spec and recognized its limitations:

  • It relied on digital signatures, which were poorly implemented and a pain to use.
  • It was designed to work on the lowest-common denominator hosting and insecure transports.
  • Many OAuth libraries are "broken" (i.e., they don't work well).
  • Many vendors wrote their own proprietary extensions, impeding standard operation. Hammer is particularly bothered by Yahoo's session extension (more later).

Because OAuth didn't do what they wanted it to do — it doesn't scale to large, high-volume systems — Yahoo, Microsoft, and Google came up with WRAP (Web Resource Authorization Protocol). Later they deprecated it in favor of OAuth 2.0.

The limitations of OAuth 1.0 were clear to everyone involved, so in 2009 a working group was founded to create OAuth 2.0. But by this point, as Hammer sees it, the establishment took over and turned a sloppy but useful system into a monstrous, complex, and frighteningly insecure one.

Microsoft, Google, Yahoo (MGY), and perhaps some other big sites bent the OAuth standardization process, which was moved into the IETF, to their needs: It's designed for large, hosted sites. It's not designed to work well with mobile clients (remember, this all happened before mobile's centrality was obvious). MGY dominated the standards process, and nobody else showed up to defend other interests.

Of course OAuth 2 claims to be secure, but Hammer says it's all security theater. The main failure comes from the abandonment of digitally signed tokens and uses unsigned "bearer tokens," relying on SSL for security. This excessive faith in SSL leaves the system open to severe attacks that sound suspiciously like the one Homakov reported. The result of these attacks can be theft of credentials, URL hijacking, and malware installation.

The original imperative of OAuth was to be simple and accessible, but MGY came up with a complex, stateful protocol that also manages to be incompatible with OAuth 1.0. WRAP, and now OAuth 2, essentially bakes the Yahoo Session Extension into the spec, so a generic client has to implement it even if some sites don't require it. It also manages to degrade user experience by forcing users to refresh tokens periodically. The lack of backward-compatibility isn't a secret; the spec announces it to the world:

1.8. Interoperability

OAuth 2.0 provides a rich authorization framework with well-defined security properties. However, as a rich and highly extensible framework with many optional components, on its own this specification is likely to produce a wide range of noninteroperable implementations.

In addition, this specification leaves a few required components partially or fully undefined (e.g., client registration, authorization server capabilities, endpoint discovery). Without these components, clients must be manually and specifically configured against a specific authorization server and resource server in order to interoperate.

This framework was designed with the clear expectation that future work will define prescriptive profiles and extensions necessary to achieve full Web-scale interoperability.

As you can see in the embedded video above, Hammer has a really bad attitude. He's mad after his OAuth experience and, to the extent that he wants to be part of the solution now, that solution is purely consumer-oriented and tells the enterprise to take all of its interests and use cases and &%*&( %^^^$ *@##@. His new project in this space is OZ.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Follow Larry Seltzer and BYTE on Twitter, Facebook, LinkedIn, and Google+: - @lseltzer @BYTE - Larry Seltzer BYTE - Larry Seltzer on LinkedIn BYTE - Larry Seltzer on Google+ View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.