Researchers discover flaws in authorisation protocol

OAuth 2.0, a security protocol popular among hackers, could enable them to perform man-in-the-middle attacks, according to researchers responsible for uncovering two vulnerabilities.

University of Trier security researchers discovered vulnerabilities in OAuth 2.0 that could allow cyber criminals to subvert sign-on systems. This particular protocol is used widely on social media websites, such as Google+ and Facebook, for user authentication.

Researchers Guido Schmitz, Ralf Küsters and Daniel Fett said that two prior unknown attacks carried out on OAuth, both managing to break the protocol’s authentication and authorisation, were discovered. The flaws were also found in the OpenID Connect standard and are able to be  exploited. These loopholes could result in user credentials being easier to obtain, and could enable hackers to impersonate users or acquire their data.

The researchers commented:

“This severe attack is caused by a logical flaw in the OAuth 2.0 protocol and depends on the presence of malicious identity provider.

“In this attack, the attacker (running a malicious RP) learns the user’s credentials when the user logs in at an IdP that uses the wrong HTTP redirection status code.”

Vulnerabilities are being found in systems up and down the UK by researchers and cyber professionals, so it’s important that businesses take note and comprehend the potential danger that they pose to any data they hold. It further illustrates the reasons behind there being more cyber security jobs available today. Businesses that are yet to have filled, or at least advertised, such positions would be wise to sit up and take notice.