Vulnerability Assessment of OAuth Implementations in Android Applications-猫眼课题宝

DOI：

10.1145/2818000.2818024

发表时间：

2015-12

期刊：

Proceedings of the 31st Annual Computer Security Applications Conference

影响因子：

--

通讯作者：

中科院分区：

其他

文献类型：

--

作者：

Hui Wang;Yuanyuan Zhang;Juanru Li;Hui Liu;Wenbo Yang;Bodong Li;Dawu Gu

在Android应用程序中加强各种OAuth实现的安全性应该全面考虑广泛的问题。由于提供商和平台的因素，Android应用程序中的OAuth实现与推荐的规范不同，并且各种实现通常变得脆弱。目前对这些OAuth实现的漏洞评估是临时的，缺乏系统的方式。因此，不安全的OAuth实现仍然被广泛使用，在许多移动应用生态系统中，情况远非乐观。针对这一问题，我们提出了一个针对Android平台OAuth实现的系统漏洞评估框架。与传统的基于限制性三方模型的OAuth安全分析不同，我们提出的框架采用系统的安全评估方法，采用五方三阶段模型来检测Android应用中流行的OAuth实现的典型漏洞。基于此框架，在整个移动应用生态系统层面对易受攻击的OAuth实施进行全面调查。本调查研究的是中国大陆移动应用市场（如b百度app Store、腾讯、安郅），涵盖15家主流OAuth服务商。我们对排名前100位的相关依赖方应用程序（RP应用程序）进行了全面评估，以检测易受攻击的OAuth实现，并进一步对4,000多个应用程序进行了实证研究，以验证开发人员滥用OAuth协议的频率。结果表明，包含OAuth服务的应用中有86.2%存在漏洞，中国大陆Android应用市场的这一比例远高于b谷歌Play的58.7%。

Enforcing security on various implementations of OAuth in Android apps should consider a wide range of issues comprehensively. OAuth implementations in Android apps differ from the recommended specification due to the provider and platform factors, and the varied implementations often become vulnerable. Current vulnerability assessments on these OAuth implementations are ad hoc and lack a systematic manner. As a result, insecure OAuth implementations are still widely used and the situation is far from optimistic in many mobile app ecosystems. To address this problem, we propose a systematic vulnerability assessment framework for OAuth implementations on Android platform. Different from traditional OAuth security analyses that are experiential with a restrictive three-party model, our proposed framework utilizes an systematic security assessing methodology that adopts a five-party, three-stage model to detect typical vulnerabilities of popular OAuth implementations in Android apps. Based on this framework, a comprehensive investigation on vulnerable OAuth implementations is conducted at the level of an entire mobile app ecosystem. The investigation studies the Chinese mainland mobile app markets (e.g., Baidu App Store, Tencent, Anzhi) that covers 15 mainstream OAuth service providers. Top 100 relevant relying party apps (RP apps) are thoroughly assessed to detect vulnerable OAuth implementations, and we further perform an empirical study of over 4,000 apps to validate how frequently developers misuse the OAuth protocol. The results demonstrate that 86.2% of the apps incorporating OAuth services are vulnerable, and this ratio of Chinese mainland Android app market is much higher than that (58.7%) of Google Play.