securing the insecure - Hakim

More documents

Recommendations

Info

1. public class TwitterClient { 2. 3. private static String key = "qSkJuxxxxxxxx76A"; 4. private static String secret = "Bs738xxxxxxxxxxxxxxZe9EhXw"; 10
server-side‣ isolate <strong>the</strong> credentials‣ protect <strong>the</strong> integrity11
Page 1 and 2: Black Hat US 2011 khash kianikha
Page 3 and 4: what’s OAuth?3
Page 5 and 6: actors:resource owner (user)resourc
Page 7 and 8: Insecure Implementation7
Page 9: OAuth flowstep 1: register client9
Page 13 and 14: “... if twitter uses the client s
Page 15 and 16: popular implementations(native apps
Page 17 and 18: open source clients‣ source code
Page 20 and 21: closed source clients‣ binary ext
Page 22 and 23: suboptimal solutions‣ client secr
Page 24: alternate flow‣ authenticate user
Page 27 and 28: password theft with Google client(a
Page 29 and 30: modify the UIWebViewDelegate’s:we
Page 31 and 32: output the Google credentials31
Page 33 and 34: ecommendations‣ client applicatio
Page 35 and 36: lure the victim to use your appdoma
Page 37 and 38: 70%* source: core impact client-sid
Page 39 and 40: uild the trap to aid exploitationli
Page 41 and 42: “but it looked so official!”OAu
Page 43 and 44: flawed session management43
Page 45 and 46: - Avon is redirected to twitter’s
Page 49 and 50: isks‣ unattended session‣ no se
Page 53 and 54: problem, meet solution‣ invalidat
Page 55: can you really changeyour password?
Page 59 and 60: solution‣ ensure compromised cred
Page 61 and 62:
take-away:use it when it makes sens
show all

securing the insecure - Hakim

Create successful ePaper yourself

Delete template?

Save as template?