If this were an actual flaw, it would completely break all of OAuth everywhere. How likely do you think it is that the entire security industry, and all hackers everywhere, would have overlooked something like this?
I'm confident there will be some sign that it's a forged OAuth prompt rather than Google's prompt, and I'm not entering credentials into an obviously fake prompt.
Well, that's lucky, because I don't want to sign up for OAuth tokens with Google and then immediately start doing something nefarious with them just to prove a point. 🙂
I looked around a little though, and I was able to find an example of this technique being used for real maliciously "in the wild." My envisioning of it was somewhat different (overriding or obfuscating the URL bar in a real window showing malicious HTML, as opposed to constructing an entire fake window), but the principle's pretty much exactly the same.
I also learned that Google's response, after some not-real-similar attacks which also exploited doing nasty things with real OAuth vendor credentials, was to tighten up a lot on their security on who can have OAuth vendor credentials (which sounds like a pretty sensible approach to me.)
Companies will include an image of your choosing when you enter your credentials to know it's really the host, and that can't be faked really. Obviously people don't notice and a fake website is often enough, but there is a mechanism.
We're doing man-in-the-middle under my proposed scenario anyway (we have to, to defeat 2FA and get a real Oauth token.) It's trivial to show the user the Google-provided image of the user's choosing.
When you use SSO to auth the website never sees your account credentials.
The site: Google, here are my SAML codes can you auth this person.
Google: cool those SAML codes are correct, hey user what are your Google auth details?
User: here you go Google.
Google: sweet, those are valid. hey site here is a token specifically for you for this user.
Site: welcome user.
At no point does your Google password hit the site and the tokens for other services will not work with a random webapp.
That's not how it works if the website serves you the genuine Oauth code.
If the website serves you a malicious imitation of the genuine Oauth code, which is crafted to make that exactly how it works, then that is in fact exactly how it works.
I only once got a real security notice from Google and this was several years ago, before Covid even. It simply stated that a (correct) login attempt was made, but from an IP address in China, and Google blocked this by default because it was "suspicious".
I changed all my passwords and have never had a problem since, but I agree with your scenario. There's ample stories of people even having 2FA set up and still getting locked out from their own accounts, although I suspect the grand majority of these cases are through social engineering rather than actual hacking.
This is why it is a bad idea that the Google (and other major) SSO use a bazillion domains and redirect you around so much. You can't really rely on the user knowing the URL of the sign-in system that way.
My account uses 2FA and my browser remembers my password. If I get a sign in prompt but my browser doesn’t / won’t auto fill my password, I assume it knows something I don’t and I’m immediately suspicious.
Your scenario is absolutely valid and would probably catch a lot of people who don’t think about security.
This seems like the kind of system that might be quite useful in extremely large organizations but is total overkill for any organisation that doesn't have dozens of departments, locations in different countries,...
In general, the flawed access control systems I have seen in the past have almost always been too convoluted and complicated compared to what a few years of use showed would have been actually needed.
Stuxnet was discovered over a decade ago and we're still seeing SCADA devices with the security equivalent of a sheep in a den of wolves with a "please don't eat me" sign hung around it's neck. At least it means job security for the foreseeable future.
netsec
Hot