There are flaws in the single sign-on (SSO) services operated by a number of portals, including Google and PayPal, security researchers said.
Idiosyncratic methods of integrating the APIs, SDKs and sample code supplied by identity providers are creating exploitable security shortcomings, according to a study by two researchers at Indiana University and one Microsoft researcher.
The process of token exchange often ends up mangled, which creates the possibility for attackers to sign into targeted accounts without having to crack an intended victim’s password, the researchers said.
The study – touted as the first field trial of web SSO systems – focused on implementation problems rather than fundamental flaws in the cryptographic techniques at play, which are fundamentally fine.
The exercise uncovered eight serious logic flaws in high-profile ID providers and relying party websites (which rely on authentication cookies to establish a user session). ID providers affected included OpenID (including Google ID and PayPal Access); Facebook; the JanRain platform; Freelancer; FarmVille; and Sears.com. Every one of the eight flaws allows an attacker to sign in as a targeted user.
The researchers – Shuo Chen of Microsoft Research and Rui Wang and XiaoFeng Wang, of Indiana University, Bloomington – have contacted the sites involved, which have deployed a fix.
The OpenID Foundation said it was investigating whether other less high profile websites suffered from similar security issues and said it was working with these ID providers to patch them up.
OpenID Foundation board members have worked to identify other websites suffering from the issue and then have them deploy a fix. There are no attacks using this technique yet.
OpenID and other web-based single sign-on programs offer the promise of reducing password headaches by allowing a user already signed in to Google, for example, to sign into other websites. This involves exchanging identity information (tokens), a process often badly applied in commercial systems, the researchers said.
The study shows security-critical logic flaws pervasively exist in these systems, which you can find from browser-relayed messages and practically exploit without access to source code or other insider knowledge of these systems.
The Microsoft/Indiana team warns they are only scratching the surface of a problem that needs wider community support to address. To push this effort the researchers are establishing a site – http://sso-analysis.org – that will allow developers and security analysts to run checks on SSO implementations.