A Primer to the OAuth Protocol
The shared secret used to verify the request signature is called the Consumer Secret. Because it is vital to the integrity of this transaction, it is imperative that this piece of data be kept secret. In the case of a Web-based Consumer, such as a Web service, it is easy to keep the Consumer Secret safe. If the Consumer is a client-side application, the Consumer Secret must be hard-coded in each copy of the application. This means the Consumer Secret potentially is discoverable, which compromises the integrity of any desktop application.
There is a known session fixation attack vulnerability found in the OAuth 1.0 protocol that allows an attacker to gain access to a target's account. The attacker logs in to the Consumer site and initiates the OAuth authorization process. The attacker saves the authorization request page instead of clicking submit. This stores the request token and secret. The attacker sends a link to a victim, which, if clicked, will continue the authorization process as started by the attacker. Once completed, the attacker will have access to the victim's protected resources via the Consumer used.
Adrian Hannah is a lifelong system administrator, trying to find a nice place to finally settle down. He is currently working for the federal government in Indiana.
|Non-Linux FOSS: Screenshotting for Fun and Profit!||Oct 20, 2016|
|Nasdaq Selects Drupal 8||Oct 19, 2016|
|Canonical Ltd.'s Ubuntu Core||Oct 19, 2016|
|Build Your Own Raspberry Pi Camera||Oct 18, 2016|
|Netlist, Inc.'s HybriDIMM Storage Class Memory||Oct 17, 2016|
|Secure Desktops with Qubes: Compartmentalization||Oct 13, 2016|
- Non-Linux FOSS: Screenshotting for Fun and Profit!
- Build Your Own Raspberry Pi Camera
- Nasdaq Selects Drupal 8
- Canonical Ltd.'s Ubuntu Core
- Secure Desktops with Qubes: Compartmentalization
- Tech Tip: Really Simple HTTP Server with Python
- Netlist, Inc.'s HybriDIMM Storage Class Memory
- The Peculiar Case of Email in the Cloud
- Linux Journal October 2016
- SUSECON 2016: Where Technology Reigns Supreme