Re: [OAUTH-WG] hijacking client's user account

Also, this is not news:
http://securityintelligence.com/spoofedme-social-login-attack-discovered-by-ibm-x-force-researchers/

On Wed, Apr 22, 2015 at 5:02 PM Justin Richer <jricher@mit.edu> wrote:

> This seems to be not a problem with OAuth but with misusing OAuth as an
> authentication protocol:
>
> http://oauth.net/articles/authentication/
>
> And with trusting unverified claims from a third party IdP (such as a
> self-asserted email address), which is covered in the OpenID Connect
> specification, an authentication protocol built on top of OAuth:
>
> http://openid.net/specs/openid-connect-core-1_0.html#ClaimStability
>
> You should probably let the client know in this case that they should not
> be using the email address as a key if they’re not verifying it themselves.
> If the authentication article can be updated to include this misuse, please
> help us amend it!
>
>  — Justin
>
> On Apr 20, 2015, at 8:55 PM, mar adrian belen <maradrianbelen@gmail.com>
> wrote:
>
> Some web application are using oauth 2 technology as login alternative , i
> found a way how can i access client application using unverified
> email(victim email) on
>
> oauth oauth provider, if oauth provider allows unverified email to use
> it's oauth service which can abuse by the attacker, this is possible if the
> client provider
>
> directly login the user(using oauth) if his email is already exists on
> they record.
>
>
> * user joe has account on CLIENT A using his email address
> victimjoe@test.com, but does not have oauth provider account. attacker
> knows that.
>
> * now the attacker create a new oauth provider account using
> victimjoe@test.com.
>
> * because an unverified email can used the oauth provider oauth and the
> CLIENT A is using oauth provider's oauth as an alternative login, the
> attacker can now access
>
> victim's Client  Application(CLIENT A) account using the login alternative
>  function.
>
>
> you can try github(oauth provider) and  https://sprint.ly/  (client)
>
>
> https://www.dropbox.com/s/jhrgn311i0e28pc/hijackoauthclient_x264.mp4?dl=0
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>
>
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth
>