A new website vulnerability allows attackers to masquerade as victims on sites that support social media logins. Here’s what to do about it.
IBM’s X Force security researchers found an easy way to gain access to Web accounts by taking advantage of an oversight in how some social login services are configured.
Those services allow someone to login to a Web service using, for example, their LinkedIn credentials. It’s a convenient way for users to create new accounts on websites by using existing information.
But in one instance, the researchers found they could gain control of accounts at Slashdot.org, Nasdaq.com, Crowdfunder.com and others by abusing LinkedIn’s social login mechanism.
LinkedIn, Amazon and Vasco, all identity providers, have all either fixed or taken measures to prevent such account takeovers, after notification from IBM, the researchers said. But the problem is one that both identity providers and third-party websites using those services should be aware of.
The attack that abuses LinkedIn is demonstrated in a video included in a blog post. The attacker creates an account with LinkedIn, using the victim’s email address.
LinkedIn will send a verification email to the victim to ensure the person has control over the address. But for the attacker’s purposes, that doesn’t matter.
Once the LinkedIn account is created, the attacker goes to Slashdot and uses the social login feature, selecting LinkedIn as the identity provider. Identity providers don’t pass along a person’s credentials to the third party site, but do transfer information such as an email address.
Slashdot.org matches the email address of the victim that was passed to it by LinkedIn to the existing account, allowing the attacker to control the account. The account could then be used to post malicious links, with people believing a trusted contact posted the content.
The researchers cautioned that the attack only works if the victim doesn’t already have an account with an identity provider.
There are two flaws in this approach: Slashdot.org shouldn’t trust the email address unless the identity provider knows it has been verified, and the identity provider should wait until the email address has been verified.
LinkedIn was vulnerable when it was using the deprecated 1.0a version of the OAuth protocol for social logins. LinkedIn also uses OAuth 2.0, which stops the authentication process if the email address is unverified, they wrote.
But “it’s worth mentioning at the time of this writing, the absolute majority of websites we encountered using LinkedIn as a provider were using the ‘deprecated’ (and vulnerable) version,” the researchers wrote.
The researchers found a similar issue with Amazon’s “Sign in with Amazon.”
“We found that in addition to allowing us to register an account with an email address we don’t own and pass it as part of the social login authentication process, it also allowed us to change the Amazon account email address to another unverified address, making it the new account’s primary email address,” they wrote.
How to protect yourself from ‘SpoofedMe,’ a social login attack
The hack is incredibly simple. First, an attacker signs up for a social login account at LinkedIn or Amazon using the victim’s email account. (Stipulation: the victim must not already have an account with that identity provider.) The victim then receives an email to verify the new account.
Here’s the catch: email verification is not needed to pull of the second phase of the hack. The attacker instead heads over to a website that supports logging in using a social account and selects “Sign In with LinkedIn” or “Log In with Amazon” or whatever relevant choice. If the attacker selects the just-created but not verified account and the victim already has a profile on the site in question—both associated with the same email address—vulnerable sites will authenticate the attacker, enabling him or her to assume the victim’s identity.
And that’s where the real trouble starts. An attacker could masquerade as a public-company executive on Nasdaq.com and comment on stocks, impacting the company’s stock performance. An attacker could post malicious links on the site under the assumed identity, subjecting anyone inquisitive enough to click to a phishing attack that allows the hacker to obtain sensitive information (that could quickly cascade into many more compromises).
“That’s a huge gaping security hole,” says Marla Hay, a senior product manager at Janrain, a company that connects websites to identity providers with social logins. (Some of the vulnerable sites—including Nasdaq.com and Slashdot.com—use the Janrain’s services.) “This is a super easy attack to make,” she adds.
Jamie Beckland, vice president of marketing at Janrain, says the onus falls on third-party websites to ensure that they’re implementing social logins securely. Even so, when Beckland’s team learned of the vulnerability through a VentureBeat article, it reached out to its clients within an hour to help them fix the flaw.
Hay recommends that companies with websites incorporating social login—so-called relying websites—take several measures. First, they should make sure to set up a field requesting a verified email address—not just any old unverified email address. Second, they should bar users from authenticating without first having verified email addresses. Lastly, they should consider accepting only identity providers that require users to verify email addresses before enabling validation through social login.
In a blog post, Or Peles, an IBM security researcher who co-authored the whitepaper describing the attack (which has been dubbed “SpoofedMe”), writes: “While fixing the identity provider vulnerability would be enough for this attack to be blocked…it is important for websites that are vulnerable to fix the website design problem because it may expose their users to similar attacks.”
Below, a video demonstration of the attack compiled by the researchers:
Credit: Jeremy Kirk
