OAuth hacking marathon - Exploiting common security pitfalls and mitigating them

OAuth has a lot of moving parts and without prior understanding it’s often difficult to understand why and how of various vulnerabilities relating to it. Hence, instead of just listing out the various security weaknesses in OAuth, our talk tries to take more storytelling approach to navigate the pitfalls in the technology. This way all the relevant concepts required are gradually introduced to the audience and they do not zone out due to lack of engagement.

The two speakers will act like two hackers trying to exploit OAuth and will switch in and out between conversations among ourselves as we’re working our way through the exploits and with the audience to make them understand the issue deeper.

This narrative & demo-based approach was chosen to also gradually increase the complexity of the attacks so the audience understands how and why exactly the vulnerability occurs. Finally after each demo the patching / fix section enlightens the audience of potential strategies to mitigate these type of attacks.

Outline

Introduction to OAuth

As part of the introduction, we will also showcase the code and infrastructure that our fictional Everything Cyber company has set up.

The demos will include -

For each demo, we will also first cover the infrastructure required so people understand typical OAuth setups.

Then we will cover the fix to the problem. There will be an emphasis on the ‘why’ so audience understands the underlying mechanics.

Authorisation server exploit demos

We will showcase how a lack of proper implementation on the authorisation server side can lead to mishaps. This time, Everything Cyber will collaborate with other apps as the resource server to allow sharing its data with others. We will see how vulnerabilities in resource and authorisation servers can lead to a myriad of issues.

Our demos will include:

OAuth 2.1 updates

We will cover the major chances upcoming in the 2.1 version and how they will help us uproot the root cause of the various issues present in 2.0.