Re: [OAUTH-WG] OAuth2 attack surface....

John Bradley <ve7jtb@ve7jtb.com> Fri, 01 March 2013 03:21 UTC

Return-Path: <ve7jtb@ve7jtb.com>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC32421F8697 for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 19:21:51 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.462
X-Spam-Level:
X-Spam-Status: No, score=-3.462 tagged_above=-999 required=5 tests=[AWL=0.136, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2rLKdmwao6vp for <oauth@ietfa.amsl.com>; Thu, 28 Feb 2013 19:21:50 -0800 (PST)
Received: from mail-da0-f43.google.com (mail-da0-f43.google.com [209.85.210.43]) by ietfa.amsl.com (Postfix) with ESMTP id 89DD521F8585 for <oauth@ietf.org>; Thu, 28 Feb 2013 19:21:50 -0800 (PST)
Received: by mail-da0-f43.google.com with SMTP id u36so1176797dak.30 for <oauth@ietf.org>; Thu, 28 Feb 2013 19:21:50 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:content-type:mime-version:subject:from:in-reply-to:date :cc:message-id:references:to:x-mailer:x-gm-message-state; bh=DYeAdJ7gr4xMt1Hke3hILEW2bDGMBQldRSN9qwg0kGA=; b=Wc7eENp+mvQyrm/CbO0QIayKvC0s0UQj+s0H638r86rwr+Bs0Fdg7BJSGEzXNivgSk Ad6ApynI1qpd7scqAvSiEVg19HIUTy5KvVOrr2TlStpmMrM/05NILJvu83wak/v3fJbg nqEOyI1D+e1IWi6r3iRg9NNyr3yPU8JgsfpkuKCbCI2BnwTSATUU2q6txrkPvCkynKER MpsvQwsRnsrrb4wwn/38X6IrpRwz7s72bAy/PZvNizOvzzeEQj6HfKohaqQaQylEjUIL 3jKYW78sfVy24p11gIZ/5Jjh0OONNfaCLtGrOW+XR6ANwLKAIHBixEUO7XLGjkzC3RCz ILKQ==
X-Received: by 10.68.211.37 with SMTP id mz5mr12723543pbc.83.1362108110115; Thu, 28 Feb 2013 19:21:50 -0800 (PST)
Received: from [192.168.6.157] (ip-64-134-220-138.public.wayport.net. [64.134.220.138]) by mx.google.com with ESMTPS id gf6sm10397395pbc.24.2013.02.28.19.21.47 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 28 Feb 2013 19:21:48 -0800 (PST)
Content-Type: multipart/signed; boundary="Apple-Mail=_072EFAA3-E14E-4AE9-B852-EC14BEECF043"; protocol="application/pkcs7-signature"; micalg=sha1
Mime-Version: 1.0 (Mac OS X Mail 6.2 \(1499\))
From: John Bradley <ve7jtb@ve7jtb.com>
In-Reply-To: <512FE091.9030508@oracle.com>
Date: Thu, 28 Feb 2013 19:21:45 -0800
Message-Id: <9C445AAF-BEE8-44F5-8FE6-43CA843906CC@ve7jtb.com>
References: <1361830944.13340.YahooMailNeo@web31812.mail.mud.yahoo.com> <E4A6D91D-2BC8-4F2E-9B1C-D1362A0E3608@oracle.com> <1361831644.50183.YahooMailNeo@web31801.mail.mud.yahoo.com> <1361832133.97884.YahooMailNeo@web31816.mail.mud.yahoo.com> <140EEABC-2787-4D9A-A1C5-6C973FED5BC8@adobe.com> <512FE091.9030508@oracle.com>
To: prateek mishra <prateek.mishra@oracle.com>
X-Mailer: Apple Mail (2.1499)
X-Gm-Message-State: ALoCoQk/uoIuUKCrzZwdQ01HwhMDHe1wgG4JAzr2aPEI7qRJ9knHWYW5r5SvE1s892ibypdJX1f4
Cc: "oauth@ietf.org" <oauth@ietf.org>
Subject: Re: [OAUTH-WG] OAuth2 attack surface....
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/oauth>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 01 Mar 2013 03:21:52 -0000

While implicit is what they are attacking, this is in principal also possible to do with a code flow if the client is public.
It is only confidential clients using the code flow that have reasonable protection from open redirectors.

In openID Connect we made registered redirect_uri and full comparison of the URI including query parameters a requirement.

Allowing path or query parameters outside of the redirect comparison leaves too large of an uncontrolled attack surface.

Implementation mistakes are almost inevitable. 

John B.
On 2013-02-28, at 2:56 PM, prateek mishra <prateek.mishra@oracle.com> wrote:

> Characteristics of both these attacks -
> 
> 1) Use of implicit flow (access token passed on the URL)
> 2) changes to redirect uri (specification does allow some flexibility here)
> 3) applications with long-lived access tokens with broad scope (in one case only)
> 
> - prateek
>> And a different one (still exploiting redirection and still implementation mistake) http://www.nirgoldshlager.com/2013/02/how-i-hacked-facebook-oauth-to-get-full.html
>> 
>> Regards
>> 
>> Antonio
>> 
>> On Feb 25, 2013, at 11:42 PM, William Mills wrote:
>> 
>>> 
>>> 
>>> DOH!!!  http://homakov.blogspot.co.uk/2013/02/hacking-facebook-with-oauth2-and-chrome.html
>>> 
>>> From: Phil Hunt <phil.hunt@oracle.com>
>>> To: William Mills <wmills_92105@yahoo.com> 
>>> Sent: Monday, February 25, 2013 2:28 PM
>>> Subject: Re: [OAUTH-WG] OAuth2 attack surface....
>>> 
>>> Whats the link?
>>> 
>>> Phil
>>> 
>>> Sent from my phone.
>>> 
>>> On 2013-02-25, at 14:22, William Mills <wmills_92105@yahoo.com> wrote:
>>> 
>>>> I think this is worth a read, I don't have time to dive into this :(
>>>> _______________________________________________
>>>> OAuth mailing list
>>>> OAuth@ietf.org
>>>> https://www.ietf.org/mailman/listinfo/oauth
>>> 
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> OAuth mailing list
>>> OAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/oauth
>> 
>> 
>> 
>> _______________________________________________
>> OAuth mailing list
>> OAuth@ietf.org
>> https://www.ietf.org/mailman/listinfo/oauth
> 
> _______________________________________________
> OAuth mailing list
> OAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/oauth