securing the insecure - Hakim

More documents

Recommendations

Info

fortune telling facebook app(a browser-based web application)a social engineering oauth application to establish user trust34
lure <strong>the</strong> victim to use your appdomain apps.facebook.com is trustworthy!phisheasy!35
Page 1 and 2: Black Hat US 2011 khash kianikha
Page 3 and 4: what’s OAuth?3
Page 5 and 6: actors:resource owner (user)resourc
Page 7 and 8: Insecure Implementation7
Page 9 and 10: OAuth flowstep 1: register client9
Page 11 and 12: server-side‣ isolate the credenti
Page 13 and 14: “... if twitter uses the client s
Page 15 and 16: popular implementations(native apps
Page 17 and 18: open source clients‣ source code
Page 20 and 21: closed source clients‣ binary ext
Page 22 and 23: suboptimal solutions‣ client secr
Page 24: alternate flow‣ authenticate user
Page 27 and 28: password theft with Google client(a
Page 29 and 30: modify the UIWebViewDelegate’s:we
Page 31 and 32: output the Google credentials31
Page 33: ecommendations‣ client applicatio
Page 37 and 38: 70%* source: core impact client-sid
Page 39 and 40: uild the trap to aid exploitationli
Page 41 and 42: “but it looked so official!”OAu
Page 43 and 44: flawed session management43
Page 45 and 46: - Avon is redirected to twitter’s
Page 49 and 50: isks‣ unattended session‣ no se
Page 53 and 54: problem, meet solution‣ invalidat
Page 55: can you really changeyour password?
Page 59 and 60: solution‣ ensure compromised cred
Page 61 and 62: take-away:use it when it makes sens

securing the insecure - Hakim

Create successful ePaper yourself

Delete template?

Save as template?