Discovering Concrete Attacks on Website Authorization by Formal Analysis

Abstract : Social sign-on and social sharing are becoming an ever more popular feature of web applications. This success is largely due to the APIs and support offered by prominent social networks, such as Facebook, Twitter, and Google, on the basis of new open standards such as the OAuth 2.0 authorization protocol. A formal analysis of these protocols must account for malicious websites and common web application vulnerabilities, such as cross-site request forgery and open redirectors. We model several configurations of the OAuth 2.0 protocol in the applied pi-calculus and verify them using ProVerif. Our models rely on WebSpi, a new library for modeling web applications and web-based attackers that is designed to help discover concrete attacks on websites. Our approach is validated by finding dozens of previously unknown vulnerabilities in popular websites such as Yahoo and WordPress, when they connect to social networks such as Twitter and Facebook.
Document type :
Reports
Liste complète des métadonnées

Cited literature [44 references]  Display  Hide  Download

https://hal.inria.fr/hal-00815834
Contributor : Antoine Delignat-Lavaud <>
Submitted on : Friday, April 19, 2013 - 2:22:46 PM
Last modification on : Friday, May 25, 2018 - 12:02:06 PM
Document(s) archivé(s) le : Saturday, July 20, 2013 - 4:02:30 AM

File

oauth.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : hal-00815834, version 1

Collections

Citation

Chetan Bansal, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Sergio Maffeis. Discovering Concrete Attacks on Website Authorization by Formal Analysis. [Research Report] RR-8287, INRIA. 2013, pp.46. ⟨hal-00815834⟩

Share

Metrics

Record views

297

Files downloads

1045