1000 Ways to Die in Mobile Oauth

on YouTube ↗47m

" summary

Field study of 600 popular mobile apps finds 149 using OAuth and 59.7% vulnerable; bugs include embedded client secrets, redirect‑URI hijacks, missing consent pages, omitted state tokens, and token‑swap/login‑CSRF attacks. Live demos show Instagram’s old flaw and Wish still vulnerable, an attacker capturing or swapping access tokens to fully impersonate victims, plus web‑view cookie exfiltration that yields long‑term Facebook session takeover. Recommendations: verify redirect URLs, keep secrets off clients, use server checks and OpenID Connect.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 13:46Brief history of OAuth
3. 17:52Vulnerability - Locally stored secrets
4. 26:49Authorization VS Authentication
5. 28:11Vulnerability. Using authorization flow for authentication
6. 32:39OAuth2 Code Authorization Flow
7. 33:22Code Authorization Flow. Verify authorization code
8. 36:36Vulnerability - Lack of Consent
9. 39:52OAuth Security State Token

" related talks

• 27mSecurity Issues In OAuth/OIDC ImplementationsAmir Sharif · sec4dev 2021
• 18mHow to Hack OAuthAaron Parecki · GOTO Chicago 2020
• 47mTop X OAuth 2 HacksAntonio Sanso · Voxxed Days Ticino 2017
• 36mHow To Hack OAuth｜Aaron Parecki · Øredev 2019
• 23mUniversal Cross-app Attacks: Exploiting and Securing OAuth 2.0 in...Wing Cheong Lau, Kaixuan Luo, Xianbo Wang, Pui Ho Adonis Fung, Julien Lecomte · USENIX Security '25
• 46mFixing authentication and authorizationTonimir Kisasondi · WebCamp Zagreb 2019
• 53mGetting API Security RightPhilippe De Ryck · NDC Security 2022
• 01h 05mCommon mistakes and misconceptions in Web App Security using OAuth 2.0 and OpenId ConnectNahid Farrokhi · NDC Sydney 2020