Warning Over Widespread Web Authentication Vulnerabilities

Warnings have been issued about serious vulnerabilities in security protocols OAuth 2.0 and OpenID, affecting a range of top web services, including Facebook, Google, LinkedIn and Microsoft.

The weaknesses could be abused to carry out what’s known as “covert redirect”, where a website does inadequate checks of partner sites when redirecting users to them.

More Internet vulnerabilities

OAuth and OpenID are designed to allow quick access to third-party sites, using tokens from an authorisation server, such as those provided by Facebook and Google.

The standards let people use logins from Facebook, Google and other popular services to access other sites. Additionally, OAuth and OpenID mean that when users click on a link taking them from one service to another, their authentication and login are quickly checked to allow speedy access.

But problems in certain pieces of OAuth and OpenID code mean a malicious hacker could tinker with pieces of a third-party’s URL and then trick a user into clicking on it.

That could either hand over the sensitive data used in authentication, or be abused to send a victim to a malicious website

The problem stems from the fact that OAuth and OpenID fail to check the URLs properly, said Wang Jing, a PhD student at the Nanyang Technological University in Singapore, in a blog post.

“For OAuth 2.0, these attacks might jeopardise the token of the site users, which could be used to access user information. In the case of Facebook, the information could include the basic ones, such as email address, age, locale, work history,” said Wang.

“For OpenID, the attackers may get user’s information directly. Compounded by the large number of companies involved, this vulnerability could lead to huge consequences if left unresolved.”

Wang claimed to have found the vulnerabilities in February, before reporting them to affected parties. A solution would be to implement a whitelist, where third parties have to register if they want users to be able to interact with their APIs.

That’s something LinkedIn has already introduced. According to Wang, Facebook said it had protections in place, but said a full whitelist might not be feasible.

He was told by Google it was investigating the issue, whilst Microsoft said it had identified a problem in a third-party site, telling Wang to notify the owner of that website. Yahoo did not respond to Wang’s notifications, he said.

The warning comes hot on the heels of Heartbleed, a vulnerability in OpenSSL, another standard designed to guarantee security on the Internet.

Are you a security pro? Try our quiz!

Thomas Brewster

Tom Brewster is TechWeek Europe's Security Correspondent. He has also been named BT Information Security Journalist of the Year in 2012 and 2013.

Recent Posts

Craig Wright Sentenced For Contempt Of Court

Suspended prison sentence for Craig Wright for “flagrant breach” of court order, after his false…

3 days ago

El Salvador To Sell Or Discontinue Bitcoin Wallet, After IMF Deal

Cash-strapped south American country agrees to sell or discontinue its national Bitcoin wallet after signing…

3 days ago

UK’s ICO Labels Google ‘Irresponsible’ For Tracking Change

Google's change will allow advertisers to track customers' digital “fingerprints”, but UK data protection watchdog…

3 days ago

EU Publishes iOS Interoperability Plans

European Commission publishes preliminary instructions to Apple on how to open up iOS to rivals,…

4 days ago

Momeni Convicted In Bob Lee Murder

San Francisco jury finds Nima Momeni guilty of second-degree murder of Cash App founder Bob…

4 days ago