gfxgfx
 
Please login or register.

Login with username, password and session length
 
gfx gfx
gfx
75368 Posts in 13193 Topics by 2639 Members - Latest Member: Selenases September 25, 2017, 08:44:30 pm
*
gfx*gfx
gfx
WinMX World :: Forum  |  Discussion  |  WinMx World News  |  Hey, you know Android apps can 'access ALL' of your Google account?
gfx
gfxgfx
 

Author Topic: Hey, you know Android apps can 'access ALL' of your Google account?  (Read 563 times)

0 Members and 1 Guest are viewing this topic.

http://www.theregister.co.uk/2013/08/06/android_oneclick_authentication_open_to_hacking/

Quote
The single-click Google account login for Android apps is a little too convenient for hackers, according to Tripwire's Craig Young, who has demonstrated a flaw in the authentication method.

The mechanism is called “weblogin”, and basically it allows users to use their Google account credentials as authentication for third-party apps, without sharing the username and password itself: a token is generated to represent the user's login details.

Young claimed the unique token used by Google's weblogin system can be harvested by a rogue app and then used to access all of the advertising's giants services as that user.

To demonstrate the flaw at this month's Def Con 21 hacking conference in Las Vegas, Young created an Android app that asks for access to the user's Google account to display stocks from Google Finance.

Assuming the user grants permission the app, it issues a token to access the requested data. The rogue app sends that token back to the hacker, who can paste it into a web session to access all of the user's Google services, said Young.

That includes unrestricted access to Gmail, Google Drive, Google Calendar and so forth, even though the permission was only given for an Android app to access Google Finance, we're told.

Users do have to give multiple permissions to the app first: to access local accounts; to access the network; and to kick off a web session accessing finance.google.com - the last bit being when the web-usable token is issued. But if the user is expecting integration with Google Finance, then none of that would surprise them.

Handing over the keys to their Google Drive files would, however.

Once the miscreant has a valid token then they could see their mark's search history, among other things. Young points out that should our victim happen to be a Google Administrator then the attacker could take control of the administered accounts, changing passwords, modifying privileges, etc.

But they'll have to move fast - Google's automated scanning may not have noticed the app's behaviour (his rogue app was only removed from the Google Play app store following a complaint despite being clearly marked as a security test) but since being informed about the vuln in February the Chocolate Factory has been working to close the security hole. (The the PC World blog has more details on the bloke's research.)

The flaw is typical of what happens when simplicity overtakes security in developers' order of priorities. It's unlikely that anyone but the most-dedicated spear-phisher would take advantage of a flaw like this, but its exposure reminds us to be aware of the permissions we grant – and keeps Google et al fixing flaws which shouldn't exist in the first place. ®

WinMX World :: Forum  |  Discussion  |  WinMx World News  |  Hey, you know Android apps can 'access ALL' of your Google account?
 

gfxgfx
gfx
©2005-2017 WinMXWorld.com. All rights reserved.
SMF 2.0.14 | SMF © 2017, Simple Machines
Page created in 0.025 seconds with 20 queries.
Helios Multi © Bloc
gfx
Powered by MySQL Powered by PHP Valid XHTML 1.0! Valid CSS!