TY - JOUR
T1 - Android single sign-on security
T2 - Issues, taxonomy and directions
AU - Liu, Xing
AU - Liu, Jiqiang
AU - Wang, Wei
AU - Zhu, Sencun
N1 - Funding Information:
Sencun Zhu received the B.S. degree in precision instruments from Tsinghua University, Beijing, China, in 1996, the M.S. degree in signal processing from the University of Science and Technology of China, Graduate School at Beijing, Hefei, China, in 1999, and the Ph.D. degree in information technology from George Mason University, Fairfax, VA, USA, in 2004. He is an Associate Professor with Penn State University. His research interests include network and systems security and software security. His research has been funded by National Science Foundation, National Security Agency, and Army Research Office/Lab.
Funding Information:
The work reported in this paper was supported in part by National Key R&D Program of China , under grant 2017YFB0802805 , in part by Science and Technology on Electronic Information Control Laboratory, China , under Grant K16GY00040 , in part by Shanghai Key Laboratory of Integrated Administration Technologies for Information Security, China , under Grant AGK2015002 , in part by the Fundamental Research Funds for the Central Universities of China , under grant K17JB00060 and K17JB00020 , and in part by National Natural Science Foundation of China , under Grant U1736114 and 61672092 . The work of Sencun Zhu was partially supported by NSF CNS-1618684 .
Funding Information:
The work reported in this paper was supported in part by National Key R&D Program of China, under grant 2017YFB0802805, in part by Science and Technology on Electronic Information Control Laboratory, China, under Grant K16GY00040, in part by Shanghai Key Laboratory of Integrated Administration Technologies for Information Security, China, under Grant AGK2015002, in part by the Fundamental Research Funds for the Central Universities of China, under grant K17JB00060 and K17JB00020, and in part by National Natural Science Foundation of China, under Grant U1736114 and 61672092. The work of Sencun Zhu was partially supported by NSFCNS-1618684.
Publisher Copyright:
© 2018 Elsevier B.V.
PY - 2018/12
Y1 - 2018/12
N2 - Single Sign-On (SSO) is a mechanism that allows a user to log in to other applications using his identity registered with an identity provider. One of the most popular protocols for SSO is OAuth 2.0, which is an open standard for authorization. However, due to the lack of detailed instructions on how to implement OAuth 2.0 on Android, there are many vulnerabilities in the current Android OAuth 2.0 implementations. While much research effort has been made to exploit such vulnerabilities, there is a lack of systematical collation and summary of these researches, resulting in the appearance of common vulnerabilities in new applications. Hence, it is crucial to collate and summarize related work. Meanwhile, the rapid development of the Internet of Things (IoT) also requires an understanding of the usage of OAuth 2.0 in the IoT environment. In this work, we first describe the OAuth 2.0 authorization code grant flow and the implicit grant flow in detail and summarize the differences between the Web environment and the Android environment that affect OAuth 2.0 security. Then, we summarize the security issues in the implementations of OAuth 2.0 on Android. These security issues include: storing client_secret or access token locally, using embedded WebView as user-agent, incorrect usage of authentication proof, handling redirection in mobile app improperly, lacking transmission protection and third-party app authentication. Attacks on these vulnerabilities, such as WebView hijacking, linking hijacking and phishing, as well as attack results are elaborated subsequently. Against these security issues and attacks, we summarize the related research work in terms of vulnerability analysis, defense, and protocol analysis. At last, we discuss the directions for mitigating these security issues and discuss some OAuth-based protocols for the IoT environment.
AB - Single Sign-On (SSO) is a mechanism that allows a user to log in to other applications using his identity registered with an identity provider. One of the most popular protocols for SSO is OAuth 2.0, which is an open standard for authorization. However, due to the lack of detailed instructions on how to implement OAuth 2.0 on Android, there are many vulnerabilities in the current Android OAuth 2.0 implementations. While much research effort has been made to exploit such vulnerabilities, there is a lack of systematical collation and summary of these researches, resulting in the appearance of common vulnerabilities in new applications. Hence, it is crucial to collate and summarize related work. Meanwhile, the rapid development of the Internet of Things (IoT) also requires an understanding of the usage of OAuth 2.0 in the IoT environment. In this work, we first describe the OAuth 2.0 authorization code grant flow and the implicit grant flow in detail and summarize the differences between the Web environment and the Android environment that affect OAuth 2.0 security. Then, we summarize the security issues in the implementations of OAuth 2.0 on Android. These security issues include: storing client_secret or access token locally, using embedded WebView as user-agent, incorrect usage of authentication proof, handling redirection in mobile app improperly, lacking transmission protection and third-party app authentication. Attacks on these vulnerabilities, such as WebView hijacking, linking hijacking and phishing, as well as attack results are elaborated subsequently. Against these security issues and attacks, we summarize the related research work in terms of vulnerability analysis, defense, and protocol analysis. At last, we discuss the directions for mitigating these security issues and discuss some OAuth-based protocols for the IoT environment.
UR - http://www.scopus.com/inward/record.url?scp=85049595271&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85049595271&partnerID=8YFLogxK
U2 - 10.1016/j.future.2018.06.049
DO - 10.1016/j.future.2018.06.049
M3 - Article
AN - SCOPUS:85049595271
SN - 0167-739X
VL - 89
SP - 402
EP - 420
JO - Future Generation Computer Systems
JF - Future Generation Computer Systems
ER -