Discovering Concrete Attacks on Website Authorization by Formal Analysis - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2012

Discovering Concrete Attacks on Website Authorization by Formal Analysis

Chetan Bansal
  • Fonction : Auteur
  • PersonId : 940498
Karthikeyan Bhargavan
Sergio Maffeis
  • Fonction : Auteur
  • PersonId : 940496

Résumé

Social sign-on and social sharing are becoming an ever more popular feature of web applications. This success is largely due to the APIs and support offered by prominent social networks, such as Facebook, Twitter, and Google, on the basis of new open standards such as the OAuth 2.0 authorization protocol. A formal analysis of these protocols must account for malicious websites and common web application vulnerabilities, such as cross-site request forgery and open redirectors. We model several configurations of the OAuth 2.0 protocol in the applied pi-calculus and verify them using ProVerif. Our models rely on WebSpi, a new library for modeling web applications and web-based attackers that is designed to help discover concrete website attacks. Our approach is validated by finding dozens of previously unknown vulnerabilities in popular websites such as Yahoo and WordPress, when they connect to social networks such as Twitter and Facebook.
Fichier principal
Vignette du fichier
discovering_concrete_attacks_csf12.pdf (288.48 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-00863385 , version 1 (18-09-2013)

Identifiants

  • HAL Id : hal-00863385 , version 1

Citer

Chetan Bansal, Karthikeyan Bhargavan, Sergio Maffeis. Discovering Concrete Attacks on Website Authorization by Formal Analysis. 25th IEEE Computer Security Foundations Symposium (CSF'12), 2012, Cambridge, MA, United States. pp.247--262. ⟨hal-00863385⟩

Collections

INRIA INRIA2
130 Consultations
609 Téléchargements

Partager

Gmail Facebook X LinkedIn More