How DTRelay Fixes Known Security Vulnerabilities In OAuth Protocols
OAuth isn’t perfect when it comes to App Security, but most developers still use it…
Normally during a request, the OAuth token is available in the request, and the only thing that keeps it protected is the SSL. But If you can get past the SSL, then you have access to the token.
LinkedIn’s Vulnerabilities
In June, 2017, Check Point researchers disclosed four major vulnerabilities in LinkedIn’s messaging service that could allow hackers to attach malware, infecting or even taking control of the machines of LinkedIn’s 500 million users (https://www.tripwire.com/state-of-security/featured/linkedin-messenger-flaws-enabled-attackers-spread-malicious-files/). Additional vulnerabilities persist from LinkedIn’s use of OAuth and HTTPS. By eliminating the need for client-side tokens and substantially improving the reliability of OAuth transactions, DTRelay can dramatically enhance the security of mobile and web applications, particularly for high-value or VIP users. DTRelay offers sound solutions to these persist threats to LinkedIn’s very large user base. This is even more important given the VIP status of many of its clients.
Amazon’s Vulnerabilities
Amazon has had 11 significant security vulnerabilities reported by CVE since 2010, including two maximum impact (10.0) flaws in Amazon’s Kindle and Fire services (https://www.cvedetails.com/vulnerability-list/vendor_id-12126/Amazon.html). Many of these vulnerabilities allow man-in-the-middle attackers to spoof servers and obtain sensitive information. In 2016, Rhino Security Labs reported vulnerabilities in Amazon’s AWS cloud hosting services (https://rhinosecuritylabs.com/penetration-testing/aws-security-vulnerabilities-and-the-attackers-perspective/). They described how misconfiguration of AWS implementation could give hackers access to sensitive data. More concerning, they describe in detail how sloppy use of the Amazon Metadata Service can hand hackers AccessKeyID, SecretAccessKey, and Token to potentially authenticate with root access, handing them the “keys to the Amazon kingdom.” Such AWS vulnerabilities led to the demise of a company in 2014, despite a “proven backup plan.” (https://arstechnica.com/information-technology/2014/06/aws-console-breach-leads-to-demise-of-service-with-proven-backup-plan/) By eliminating the need for consumer tokens and substantially improving the reliability of both OAuth transactions, DTRelay can dramatically enhance the security of mobile and web applications, particularly for high-value or VIP users. DTRelay’s use of protected parameters also prevents owner_id vulnerabilities.
Yahoo’s Vulnerabilities
Yahoo had three billion user accounts compromised in 2013, a 2016 disclosure that has been widely publicized (http://money.cnn.com/2017/10/03/technology/business/yahoo-breach-3-billion-accounts/index.html). In 2014, hackers compromised 500 million accounts. CVE has documented 65 vulnerabilities across 14 Yahoo products, dating back to 1999 (http://www.cvedetails.com/vendor/290/Yahoo.html). By depending on algorithms to obfuscate protected information, YQL secure storage is vulnerable to Cross-Site Request Forgery (CSRF) attacks. DTRelay provides an alternative security strategy that is not prone to this type of attack. DTRelay can dramatically enhance the security of mobile and web applications, particularly for high-value or VIP users. DTRelay’s use of protected parameters also prevents owner_id vulnerabilities.
Microsoft’s Vulnerabilities
CVE has documented 5,330 security vulnerabilities in 456 Microsoft products since 1999, 598 of these in 2017 alone (https://www.cvedetails.com/vendor/26/Microsoft.html). Over 20 percent of these involve the most egregious categories of access to privileges and access to information. The rate of increase took a dramatic turn for the worse in 2012, with 2017 numbers up almost 400% from then. In July of 2017, Microsoft had to patch 54 vulnerabilities in Windows, Edge, Internet Explorer, Office and Exchange (https://threatpost.com/microsoft-patch-tuesday-update-fixes-19-critical-vulnerabilities/126758/). 19 of these were considered critical vulnerabilities, enabling hackers to do remote code execution, take control of systems, corrupt memory, and exploit vulnerabilities in the JavaScript execution engine itself. By eliminating the need for consumer tokens and substantially improving the reliability of OAuth transactions, DTRelay can dramatically enhance the security of mobile and web applications, particularly for high-value or VIP users.
Single-Factor Authentication Vulnerabilities
Lyft uses a single-factor authentication that depends only on a user’s phone number, a strategy that has resulted in unauthorized charges to users’ credit cards (https://www.csoonline.com/article/3134859/security/lyft-customers-face-potential-hack-from-recycled-phone-numbers.html). Hackers can target high-profile individuals using pervasive OAuth protocols over public WIFI to obtain user tokens, which they can then use to gain access to even the most heavily protected servers. Such access, in skilled hands, could threaten other Lyft customers as well.
If your business depends on the security of your clients, let us show you your vulnerabilities and how DTRelay can help.