OAuth 2.0 Protocol Exposes 1 Billion Mobile Applications To Account Hacking

Source: https://threatpost.com/oauth-2-0-hack-exposes-1-billion-mobile-apps-to-account-hijacking/121889/, http://securityaffairs.co/wordpress/53081/hacking/oauth-2-0-attack.html (SecurityWeek, SecuirtyAffairs)

Researchers from the Chinese of Hong Kong discovered a mass popular applications that use single sign-on(SSO) are vulnerable because they aren’t properly implementing the OAuth 2.0 protocol.  This protocol is used everyday by billions of users who access third-party services by verifying their identity through popular web services like Google, Facebook, or Sina.

Users can sign-in to any service without providing additional usernames or passwords, this happens when a user logs into a third party application via OAuth and the app will check with ID of the provider (i.e. Facebook, Google). The ID provider like Facebook or Google will provide an Access Token to the server of the original requesting mobile app and it will use the request to validate the identity of the user. Though the Chinese researchers found that numerous Android applications were not properly checking the validity of the information being passed by the ID provider, instead it merely checked if the information was being passed by a legitimate ID provider. This opens up a door to an attacker installing a flawed app on their own mobile device, then logging into their own account and simply changing their username to the victims by setting up a server to modify the data sent to Facebook, Google, or other ID providers. Through this technique an attacker can access data from the flawed app which could lead to potentially exposing sensitive information in the app or allowing an attacker to use the app as being the victim.