一句话：提出 OAuth 漏洞静态检查工具 OAUTHLINT，并在 600+ 热门 Android 应用中实证发现广泛 OAuth 安全错误。
移动开发者常用 OAuth API 实现单点登录，但 OAuth 最初为第三方网站授权而非移动应用认证设计，错误实现会导致数据泄露和账户被攻破。本文实证研究 Android 应用中 OAuth API 的使用及安全影响，提出 OAUTHLINT：其以从 OAuth 规范中提取的脆弱模式所编码的反协议和程序为输入，采用查询驱动的静态分析，检查程序可行执行轨迹是否匹配反协议并生成反例。作者对 Google Play 上 600 多个下载量超一千万的热门应用进行评估，发现使用 OAuth API 的 316 个应用中有 101 个（32%）至少存在一处安全错误。
Mobile developers use OAuth APIs to implement Single-Sign-On services. However, the OAuth protocol was originally designed for the authorization for third-party websites not to authenticate users in third-party mobile apps. As a result, it is challenging for developers to correctly implement mobile OAuth securely. These vulnerabilities due to the misunderstanding of OAuth and inexperience of developers could lead to data leakage and account breach. In this paper, we perform an empirical study on the usage of OAuth APIs in Android applications and their security implications. In particular, we develop OAUTHLINT, that incorporates a query-driven static analysis to automatically check programs on the Google Play marketplace. OAUTHLINT takes as input an anti-protocol that encodes a vulnerable pattern extracted from the OAuth specifications and a program P. Our tool then generates a counter-example if the anti-protocol can match a trace of Ps possible executions. To evaluate the effectiveness of our approach, we perform a systematic study on 600+ popular apps which have more than 10 millions of downloads. The evaluation shows that 101 (32%) out of 316 applications that use OAuth APIs make at least one security mistake.
DOI 原文 ·
@inproceedings{paperbot5216,
title = {OAUTHLINT: An Empirical Study on OAuth Bugs in Android Applications},
author = {Tamjid Al Rahat and Yu Feng and Yuan Tian},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00036}
}