Bug in OAuth 2.0 and OpenID gives hackers access to privacy data

A student from Singapore has discovered a bug in OAuth 2.0 and OpenID. By the bug, hackers can data of users of Google, Facebook and Microsoft to steal. This is possible by mimicking inlogschermen.

The bug, that the student is Covert Redirect is called, allows an attacker to a user via a posted link on for example, Facebook, a pop-up screen to show an app to authorization requests. In the address bar of the pop-up is the url of Facebook is shown. After the user credentials are entered, and the app has been authorized, send the pop-up this to the attacker. What the pop-up also redirects, depending on the permissions that the app be given. Then the user is redirected to a website that the hacker is pre-set.

Among the companies that use OAuth 2.0 and OpenID include Facebook, Google, LinkedIn and Microsoft. The student to Cnet know that the problem is because Google is being investigated and that LinkedIn will soon be a blog release about the bug. Microsoft had the bug been investigated and no action. The company found out that the bug does not appear on its own web sites but only on those of third parties.

Comments
(40)