SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities Yuchen Zhou, and David Evans 23rd USENIX Security Symposium, August, 2014 Chun-Yi Wang

Heuristics Evaluation Outline Introduction Background SSOScan Results Heuristics Evaluation Discussion

Single Sign-On Service Introduction Background SSOScan Results Heuristics Evaluation Discussion Single Sign-On Service

Single Sign-On Service Introduction Background SSOScan Results Heuristics Evaluation Discussion Single Sign-On Service Allow users to log into an applicationusing an established account (with a service such as Facebook or Twitter) Connect their account on the new site to an established Internet identity

Single Sign-On Workflow Introduction Background SSOScan Results Heuristics Evaluation Discussion Single Sign-On Workflow

Single Sign-On Workflow Introduction Background SSOScan Results Heuristics Evaluation Discussion Single Sign-On Workflow OAuth uses three different types of credentials: Access_token Represents permissions granted by the user Eventually expires, but may be valid for a long time

Single Sign-On Workflow Introduction Background SSOScan Results Heuristics Evaluation Discussion Single Sign-On Workflow Code Used to exchange for an access_token through the identity provider Requires the application’s unique app_secret to proceed With Facebook SSO, the code expires after being used in the first exchange

Single Sign-On Workflow Introduction Background SSOScan Results Heuristics Evaluation Discussion Single Sign-On Workflow Signed_request A base64 encoded string that contains a user identity, a code, and a signature Can be verified using an application’s app_secret and some other metainformation Once issued, it is not tied to Facebook (except for the enveloped code), and the signature can be verified locally

Integrating SSO services Introduction Background SSOScan Results Heuristics Evaluation Discussion Integrating SSO services

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities

Vulnerabilities - Credential Misuse Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities - Credential Misuse Access_token misuse In OAuth 2.0, when a service uses an access_token to authenticate users, it will also accept ones granted to any other application Signed_request misuse Information is decoded from a Signed_request but the signature is never checked

Vulnerabilities - Credential Misuse Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities - Credential Misuse

Vulnerabilities - Credential Leakage Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities - Credential Leakage App_secret leak When a developer registers an application with Facebook, he receives an app_secret App_secret is used as the key to create signed_requests and to access many other privileged functionalities

Vulnerabilities - Credential Leakage Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities - Credential Leakage App_secret leak By design, the code and app secret must be sent from the application’s back end server to Facebook in exchange for an access token When this exchange is carried out through the client instead of the server, app secret is exposed to any malicious client

Vulnerabilities - Credential Leakage Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities - Credential Leakage User OAuth credentials leak - 1 Facebook OAuth landing page contains third-party content automatically include OAuth credentials in the referer header To thwart this leakage, only allowing access token and signed request to appear in the URL fragments

Vulnerabilities - Credential Leakage Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities - Credential Leakage User OAuth credentials leak - 2 credentials can be exfiltrated by third-party scripts if they are present in the page content If a malicious party is able to obtain these credentials, it could carry out impersonation attacks or perform malicious actions using permissions the user granted the original application

Vulnerabilities - Credential Leakage Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerabilities - Credential Leakage

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Related Work Program analysis Automated security testing Automated GUI testing Human cooperative testing Single sign-on security

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion SSOScan Components

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Enroller

Enroller – SSO Button Finder Introduction Background SSOScan Results Heuristics Evaluation Discussion Enroller – SSO Button Finder

Enroller – SSO Button Finder Introduction Background SSOScan Results Heuristics Evaluation Discussion Enroller – SSO Button Finder

Enroller – SSO Button Finder Introduction Background SSOScan Results Heuristics Evaluation Discussion Enroller – SSO Button Finder

Enroller – Registration Automation Introduction Background SSOScan Results Heuristics Evaluation Discussion Enroller – Registration Automation

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Oracle

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Vulnerability Tester Simulated Attacks Passive Monitoring

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Overview

Automated Test Results Introduction Background SSOScan Results Heuristics Evaluation Discussion Automated Test Results

Automated Test Results Introduction Background SSOScan Results Heuristics Evaluation Discussion Automated Test Results

Automated Test Results Introduction Background SSOScan Results Heuristics Evaluation Discussion Automated Test Results

Automated Test Results Introduction Background SSOScan Results Heuristics Evaluation Discussion Automated Test Results

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Detection Accuracy Facebook Login Detection Correctness Vulnerability Status Correctness Trusted Third-Party Domains

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Automation Failures Registration automation failure Oracle confusion Others

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Options Candidate rank Visibility filter Position filter Registration form filter Element content matching

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Experiment Setup

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Results Element type and content Element size Element position

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Validation

Communication and Responses - from vendors Introduction Background SSOScan Results Heuristics Evaluation Discussion Communication and Responses - from vendors

Communication and Responses - from Facebook Introduction Background SSOScan Results Heuristics Evaluation Discussion Communication and Responses - from Facebook Contacted Facebook on May 2014 regarding the vulnerable websites Facebook is more concerned with those that Leak access_token through referer header Misuse any type of OAuth credential

Communication and Responses - from Facebook Introduction Background SSOScan Results Heuristics Evaluation Discussion Communication and Responses - from Facebook We reported 95 of such cases to Facebook and Facebook responded: “We have notified and taken appropriate actions against those sites” Only 4 out of 95 fixed their issues as of our latest test result.

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Conclusion SSOScan shows roughly 20% of the top ranked websites suffer from SSO vulnerabilities Notifying vendors, or even the identity provider, are not as effective as one might expect

Heuristics Evaluation Introduction Background SSOScan Results Heuristics Evaluation Discussion Conclusion SSOScan deployment opportunities Integrated at identity provider app center / app store Ensure application security by shutting down vulnerable app’s access Checking-as-a-service

Thanks! Questions?