Abstract:On modern operating systems, applications under the same user are separated from each other, for the purpose of protecting them against malware and compromised programs. Given the complexity of today's OSes, less clear is whether such isolation is effective against different kind of cross-app resource access attacks (called XARA in our research). To better understand the problem, on the less-studied Apple platforms, we conducted a systematic security analysis on MAC OS~X and iOS. Our research leads to the discovery of a series of high-impact security weaknesses, which enable a sandboxed malicious app, approved by the Apple Stores, to gain unauthorized access to other apps' sensitive data. More specifically, we found that the inter-app interaction services, including the keychain, WebSocket and NSConnection on OS~X and URL Scheme on the MAC OS and iOS, can all be exploited by the malware to steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote. Further, the design of the app sandbox on OS~X was found to be vulnerable, exposing an app's private directory to the sandboxed malware that hijacks its Apple Bundle ID. As a result, sensitive user data, like the notes and user contacts under Evernote and photos under WeChat, have all been disclosed. Fundamentally, these problems are caused by the lack of app-to-app and app-to-OS authentications. To better understand their impacts, we developed a scanner that automatically analyzes the binaries of MAC OS and iOS apps to determine whether proper protection is missing in their code. Running it on hundreds of binaries, we confirmed the pervasiveness of the weaknesses among high-impact Apple apps. Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed.

The Achilles heel of OAuth: a multi-platform study of OAuth-based authentication.

Vulnerability Assessment of OAuth Implementations in Android Applications

Simple But Not Secure : An Empirical Security Analysis of OAuth 2 . 0-Based Single Sign-On Systems

Security Analysis of OAuth 2.0 Implementation

OAuthGuard: Protecting User Security and Privacy with OAuth 2.0 and OpenID Connect

Exploring Privacy Implications in OAuth Deployments

Evaluation of Secure OpenID-Based RAAA User Authentication Protocol for Preventing Specific Web Attacks in Web Apps

SIMulation: Demystifying (insecure) Cellular Network Based One-Tap Authentication Services

Mitigating CSRF attacks on OAuth 2.0 and OpenID Connect

Appcracker: Widespread vulnerabilities in user and session authentication in mobile apps

Machine learning approach to vulnerability detection in OAuth 2.0 authentication and authorization flow

Open Sesame! Web Authentication Cracking Via Mobile App Analysis.

Decentralized Authorization and Authentication Based on Consortium Blockchain.

On the Insecurity of SMS One-Time Password Messages Against Local Attackers in Modern Mobile Devices

An Empirical Study of SDK Credential Misuse in Ios Apps

An analysis of social network connect services

"Make Them Change it Every Week!": A Qualitative Exploration of Online Developer Advice on Usable and Secure Authentication

Do not trust me: Using malicious IdPs for analyzing and attacking Single Sign-On

Method of Resource Authentication Adapting for WoT Architecture

Finding Vulnerabilities in Mobile Application APIs: A Modular Programmatic Approach

Unauthorized Cross-App Resource Access on MAC OS X and iOS