OAUTHLINT: An Empirical Study on OAuth Bugs in Android Applications

DOI 10.1109/ase.2019.00036 dblp

Abstract

Mobile developers use OAuth APIs to implement Single-Sign-On services. However, the OAuth protocol was originally designed for the authorization for third-party websites not to authenticate users in third-party mobile apps. As a result, it is challenging for developers to correctly implement mobile OAuth securely. These vulnerabilities due to the misunderstanding of OAuth and inexperience of developers could lead to data leakage and account breach. In this paper, we perform an empirical study on the usage of OAuth APIs in Android applications and their security implications. In particular, we develop OAUTHLINT, that incorporates a query-driven static analysis to automatically check programs on the Google Play marketplace. OAUTHLINT takes as input an anti-protocol that encodes a vulnerable pattern extracted from the OAuth specifications and a program P. Our tool then generates a counter-example if the anti-protocol can match a trace of Ps possible executions. To evaluate the effectiveness of our approach, we perform a systematic study on 600+ popular apps which have more than 10 millions of downloads. The evaluation shows that 101 (32%) out of 316 applications that use OAuth APIs make at least one security mistake.

BibTeX

@inproceedings{Rahat-al:ASE19,
  author    = {Tamjid Al Rahat and
               Yu Feng and
               Yuan Tian},
  title     = {{OAUTHLINT:} An Empirical Study on {OAuth} Bugs in Android Applications},
  booktitle = {ASE},
  pages     = {293--304},
  publisher = {{IEEE}},
  year      = {2019},
}

OAUTHLINT: An Empirical Study on OAuth Bugs in Android Applications

Abstract

Related papers