Measuring and Mitigating OAuth Access Token Abuse by Collusion Networks Shehroze Farooqi1, Fareed Zaffar2, Nektarios Leontiadis3, Zubair Shafiq1 University of Iowa1, Lahore University of Management Sciences2, Facebook3 Shehroze Farooqi

Key Contributions Security Issue Measurement Countermeasures OAuth access token leakage Measurement Abuse of leaked access tokens by collusion networks Countermeasures Mitigation of access token abuse Shehroze Farooqi

Outline Security Issue Measurement Countermeasures OAuth access token leakage Measurement Abuse of leaked access tokens Countermeasures Mitigation of access token abuse Shehroze Farooqi

Third-party applications OAuth Authorization framework OAuth 2.0 [RFC 6749] Enable third-party applications to get restricted access to online services Online services Third-party applications Shehroze Farooqi

Single Sign On (SSO) Shehroze Farooqi

Access Token An opaque string Represents authorization issued to the third-party application Provides an alternate of sharing username/password EAACEdEose0cBAAP8fZCGOTmVi5wZAW4pUfZCf1cEEQaCAWEP7AOFqZCVOlesGdVI1ubVYcnbmU59FZAJsjMV65LFxzyVo Shehroze Farooqi

OAuth Workflow of Facebook Applications Server-side flow Client-side flow Shehroze Farooqi

OAuth Workflow of Facebook Applications Server-side flow Client-side flow Shehroze Farooqi

OAuth Workflow of Facebook Applications Server-side flow Client-side flow Shehroze Farooqi

Client-side Flow Benefits of the client-side flow Provides support for the applications without server Cross-platform interoperability Used by many browser-based applications such as games Security issues with client-side flow Applications are susceptible to access token leakage [RFC 6819] Focus on the applications susceptible to access token leakage Shehroze Farooqi

Identification of Susceptible Applications Scanned 100 most popular applications Identified 9 susceptible applications Application name Monthly active users rank Spotify 4 PlayStation Network 57 Deezer 59 Pandora 68 HTC Sense 75 Top 5 susceptible applications Shehroze Farooqi

Implications of leaked access tokens Passive: Steal personal information Email, location, birth date, work history Active: Conduct malicious activities Spread malware Reputation manipulation e.g., fake likes, fake comments Shehroze Farooqi

Outline Security Issue Measurement Countermeasures OAuth access token leakage Measurement Abuse of leaked access tokens Countermeasures Mitigation of access token abuse Shehroze Farooqi

Collusion Networks Users deliberately submit access tokens In exchange get likes and comments Large scale abuse of leaked access tokens Fake likes, fake comments Exploit top applications with millions of active users E.g., HTC Sense (1 million monthly active users) Identified 50 collusion network websites E.g., hublaa.me, official-liker.net Shehroze Farooqi

Install Application Retrieve Access Token Submit Access Token Shehroze Farooqi

Milking Collusion Networks Deployed honeypot accounts to milk collusion networks Create a dummy post on Facebook Join a collusion network by submitting the access token Regularly submit posts to get likes and comments Automated the process for all collusion networks Shehroze Farooqi

Milking Process Steady increase in likes count Repetition of unique users Diminishing returns f8-autoliker.com Shehroze Farooqi

Summary of collected data Submitted 11K+ posts Received 2.7 Million likes Identified over a million members Collusion network Number of Posts Submitted Number of Likes Membership Size Official-liker.net 1,757 685,88 233,161 Hublaa.me 1,421 496,714 294,949 F8-autolikers.com 1,311 331,923 72,157 All 11,751 2,753,153 1,150,782 Top 3 Collusion Networks Shehroze Farooqi

Outline Security Issue Measurement Countermeasures OAuth access token leakage Measurement Abuse of leaked access tokens Countermeasures Mitigation of access token abuse Shehroze Farooqi

Challenges in Proposing Countermeasures Block susceptible applications Impact legitimate users Disable the client-side flow Applications without server Platform usability False positives Detection accuracy Shehroze Farooqi

Proposed Countermeasures Access token rate limits Honeypot based access token invalidation Temporal clustering IP rate limits Shehroze Farooqi

Impact of Countermeasures Experimental Setup Shehroze Farooqi

Impact of Countermeasures Establishing baseline Shehroze Farooqi

Impact of Countermeasures Reduction in access token rate limit Shehroze Farooqi

Impact of Countermeasures Access token invalidation – Half of all tokens Shehroze Farooqi

Impact of Countermeasures Access token invalidation – All tokens Shehroze Farooqi

Impact of Countermeasures Access token invalidation – Half of new tokens daily Shehroze Farooqi

Impact of Countermeasures Access token invalidation – All new tokens daily Shehroze Farooqi

Impact of Countermeasures Clustering based access token invalidation Shehroze Farooqi

Impact of Countermeasures IP address rate limits Shehroze Farooqi

Key Takeaways Countermeasures Security issues in OAuth Arms race – Proven to be long lasting Robustness Security issues in OAuth Similar access token leakage and abuse on other online services Investigate other OAuth security flaws and potential attacks Shehroze Farooqi

Questions? Email: shehroze-farooqi@uiowa.edu Webpage: www.sites.google.com/site/shehrozefarooqi/ Questions? Shehroze Farooqi