Hacking OAuth 2.0

Transcript

1. Hacking
 
 
 OAuth 2.0 @marcin_hoppe
2. Past, present, and future @marcin_hoppe ... told by one security team
3. IDaaS Identity protocols Product security team @marcin_hoppe
4. Protocols and standards @marcin_hoppe PKCE OIDC OAuth 2.0 SAML JWT WS-Federation
5. @marcin_hoppe OAuth 2.0 Authorization Code Flow IdP App UA code access token
6. How to test for security flaws? @marcin_hoppe
7. Existing resources Security considerations in RFCs Threat model RFC and security BCP Formal security model @marcin_hoppe
8. Good enough? @marcin_hoppe
9. No, but a great start! @marcin_hoppe
10. OAuth attack library Structured attack documentation Useful for offensive security crowd Automation! @marcin_hoppe
12. Meanwhile in the real world... @marcin_hoppe
13. Redirects are tricky Cookies + state binding in URL UA navigates in and out of the page Potential for CSRF, session fixation, open redirects... @marcin_hoppe
14. Existing resources are generic! @marcin_hoppe
23. Generic threat models do not cover this complexity! @marcin_hoppe
24. Protocols as FSMs Each prompt is a state Only some state transitions allowed Security properties for states and transitions @marcin_hoppe
25. How to generate FSMs? Source: ideal but difficult Runtime: test instrumentation DOT language + GraphViz @marcin_hoppe
26. Our stack Node.js runtime Express middleware Passport authentication Flowstate FSMs @marcin_hoppe
27. Example simple FSM @marcin_hoppe /authorize /login /mfa /pwdreset /consent
28. How to analyze FSMs? Threat modeling: STRIDE State bypass Session management @marcin_hoppe
29. Takeaways Protocol testing is hard Existing resources: useful but generic FSMs help with specific systems @marcin_hoppe
30. Marcin Hoppe Senior Manager Product Security Auth0 Security Working Group Node.js Foundation Project Leader OWASP Serverless Top 10 marcin.hoppe @ auth0.com twitter.com/Marcin_Hoppe
31. Ask me anything! @marcin_hoppe