一句话：提出基于状态机模型的 SSO 漏洞扫描器 MoScan，通过分析网络踪迹生成测试载荷发现实现中的安全缺陷。
第三方 SSO 服务广泛用于 Web 应用的认证与授权，但安全集成困难，近年漏洞频报。MoScan 面向软件测试人员和安全分析员，输入是基于 SSO 标准与实证研究构建的状态机，表示登录过程中各参与方的状态和迁移；测试时捕获并分析 SSO 服务执行期间的网络踪迹，增量更新状态机，并据此生成载荷测试协议参与方。作者用 23 个集成 Facebook SSO 的真实网站评估其漏洞识别能力，并在 Twitter、LinkedIn SSO 及 Jenkins 的 GitHub 认证插件上验证状态机适应性，检测出 3 个已知弱点和 1 个新逻辑缺陷。
Various third-party single sign-on (SSO) services (e.g., Facebook Login and Twitter Login) are widely deployed by web applications to facilitate their authentication and authorization processes. Nevertheless, integrating these services in a secure manner remains challenging, such that security issues are continually reported in recent years. In this work, we develop MoScan, a model-based scanner that can be used by software testers and security analysts for detecting and reporting security vulnerabilities in SSO implementations. MoScan takes as input a state machine built based on an SSO standard and our empirical study to represent participants' states and transitions during the login process. In the testing process, it analyzes network traces captured during the execution of SSO services, and increments the state machine which is then used to generate payloads to test the protocol participants. We evaluate MoScan with 23 real-world websites which integrate the Facebook SSO service to test its capability of identifying security vulnerabilities. To show the adaptability of MoScan's state machine, we also test it on Twitter and LinkedIn’s SSO services, and Github's authentication plugin in Jenkins. It detects three known weaknesses and one new logic fault from them, showing a new perspective in testing stateful protocol implementations like SSO services. Our demonstration and the source code of MoScan are available at https://github.com/baigd/moscan.
@inproceedings{paperbot6678,
title = {MoScan: a model-based vulnerability scanner for web single sign-on services},
author = {Hanlin Wei and Behnaz Hassanshahi and Guangdong Bai and Padmanabhan Krishnan and Kostyantyn Vorobyov},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3469081}
}