[Paper Review] OAuthGuard: Protecting User Security and Privacy with OAuth 2.0 and OpenID Connect

Wanpeng Li, Chris J. Mitchell+1 more|arXiv (Cornell University)|Jan 24, 2019

Web Application Security Vulnerabilities19 references4 citations

TL;DR

OAuthGuard is a Chrome extension that detects and mitigates five OAuth 2.0 and OpenID Connect vulnerabilities—including one previously undocumented privacy flaw—in relying parties (RPs) using Google's sign-in service. It protects users in real time by blocking token leaks, enforcing HTTPS, detecting CSRF attacks via referer header analysis, and warning users of impersonation risks, successfully securing 56 of 69 vulnerable RPs in a study of the top 1,000 websites.

ABSTRACT

Millions of users routinely use Google to log in to websites supporting OAuth 2.0 or OpenID Connect; the security of OAuth 2.0 and OpenID Connect is therefore of critical importance. As revealed in previous studies, in practice RPs often implement OAuth 2.0 incorrectly, and so many real-world OAuth 2.0 and OpenID Connect systems are vulnerable to attack. However, users of such flawed systems are typically unaware of these issues, and so are at risk of attacks which could result in unauthorised access to the victim user's account at an RP. In order to address this threat, we have developed OAuthGuard, an OAuth 2.0 and OpenID Connect vulnerability scanner and protector, that works with RPs using Google OAuth 2.0 and OpenID Connect services. It protects user security and privacy even when RPs do not implement OAuth 2.0 or OpenID Connect correctly. We used OAuthGuard to survey the 1000 top-ranked websites supporting Google sign-in for the possible presence of five OAuth 2.0 or OpenID Connect security and privacy vulnerabilities, of which one has not previously been described in the literature. Of the 137 sites in our study that employ Google Sign-in, 69 were found to suffer from at least one serious vulnerability. OAuthGuard was able to protect user security and privacy for 56 of these 69 RPs, and for the other 13 was able to warn users that they were using an insecure implementation.

Motivation & Objective

• To address the critical security and privacy risks posed by widespread misimplementations of OAuth 2.0 and OpenID Connect in real-world relying parties (RPs).
• To provide end-user protection against vulnerabilities in RP OAuth 2.0 and OpenID Connect implementations, even when RPs do not follow best practices.
• To detect and mitigate five specific vulnerabilities, including a novel privacy flaw, in RPs using Google's SSO service.
• To offer a practical, deployable solution that operates at the client-side, enabling users to remain protected without requiring RP-level changes.

Proposed method

• OAuthGuard analyzes HTTP messages in real time during the OAuth 2.0 and OpenID Connect flow to detect security and privacy flaws.
• It uses referer header analysis to detect CSRF attacks, even when RPs lack proper CSRF countermeasures.
• The tool blocks HTTP-to-HTTPS downgrade attacks by enforcing HTTPS for OAuth 2.0 responses.
• It identifies and blocks third-party token leaks by monitoring for unauthorized outbound requests containing access tokens.
• It issues warnings to users when impersonation vulnerabilities are detected, based on malformed or missing authentication parameters.
• The system is implemented as a Chrome extension and integrates with Google's OAuth 2.0 and OpenID Connect services.

Experimental results

Research questions

• RQ1 What are the most prevalent OAuth 2.0 and OpenID Connect vulnerabilities in real-world relying parties using Google sign-in?
• RQ2 Can a client-side tool effectively detect and mitigate vulnerabilities in RP implementations without requiring changes to the RP or IdP?
• RQ3 What is the prevalence of a previously undocumented privacy vulnerability in OAuth 2.0 and OpenID Connect implementations?
• RQ4 How effective is a referer header-based CSRF detection mechanism in real-world scenarios where RPs lack proper CSRF protections?
• RQ5 To what extent can a client-side tool like OAuthGuard improve user security and privacy in the absence of proper RP implementation?

Key findings

• Of the 137 top 1,000 websites using Google Sign-in, 69 were found to suffer from at least one serious OAuth 2.0 or OpenID Connect vulnerability.
• OAuthGuard successfully protected user security and privacy for 56 of the 69 vulnerable RPs, primarily by mitigating CSRF attacks and token leaks.
• The tool detected and blocked 75 HTTP requests that leaked user tokens to third-party websites across nine RPs.
• For 48 of 53 RPs vulnerable to CSRF attacks, OAuthGuard successfully mitigated the threat using referer header analysis.
• OAuthGuard issued warnings for 13 RPs vulnerable to impersonation attacks, which were not previously detectable by existing tools.
• The study revealed that 25 of 109 RPs not flagged for CSRF by OAuthGuard were still vulnerable, indicating that some flaws require deeper analysis beyond message-level inspection.