Over 1 Billion Mobile App Accounts can be Hijacked Remotely with this Simple Hack (oAuth)

[Alpha1]

Security researchers have discovered a way to target a huge number of Android and iOS apps that could allow them to remotely sign into any victim's mobile app account without any knowledge of the victim.

A group of three researchers – Ronghai Yang, Wing Cheong Lau, and Tianyu Liu – from the Chinese University of Hong Kong has found [PPT] that most of the popular mobile apps that support single sign-on (SSO) service have insecurely implemented OAuth 2.0.

OAuth 2.0 is an open standard for authorization that allows users to sign in for other third-party services by verifying existing identity of their Google, Facebook, or Chinese firm Sina accounts.

Read more:
https://www.blackhat.com/docs/eu-16...ion-Mobile-Apps-Effortlessly-With-OAuth20.pdf
http://thehackernews.com/2016/11/android-oauth-hacking.html

 

[Alpha1]

As a result of this news various services have discontinued oAuth login immediately.

 

[Alpha1]

Its also worth mentioning that this method to hack oAuth was presented at the Black Hat Europe 2016 conference:
https://www.blackhat.com/eu-16/
So every hacker and their dog knows about it now.

 

[Amin Sabet]

What does this mean for us? Should we disable Facebook login on our XenForo sites?

@vbresults - does this affect TMA apps?

 

[vbresults]

What does this mean for us? Should we disable Facebook login on our XenForo sites?

@vbresults - does this affect TMA apps?

No, it does not; TMA does not implement OAuth.