'SpoofedMe' attacks exploited LinkedIn, Amazon social login flaws

IBM found several problems in how login credentials can be used for other websites

IBM's X Force security researchers found an easy way to gain access to Web accounts by taking an advantage of an oversight in how some social login services are configured.

Those services allow someone to login to a Web service using, for example, their LinkedIn credentials. It's a convenient way for users to create new accounts on websites by using existing information.

But in one instance, the researchers found they could gain control of accounts at Slashdot.org, Nasdaq.com, Crowdfunder.com and others by abusing LinkedIn's social login mechanism.

Other identity services were also found to be vulnerable to the "SpoofedMe" attack, wrote Or Peles and Roee Hay of IBM Security Systems.

LinkedIn, Amazon and Vasco, all identity providers, have all either fixed or taken measures to prevent such account takeovers, after notification from IBM, the researchers said. But the problem is one that both identity providers and third-party websites using those services should be aware of.

The attack that abuses LinkedIn is demonstrated in a video included in a blog post. The attacker creates an account with LinkedIn, using the victim's email address.

LinkedIn will send a verification email to the victim to ensure the person has control over the address. But for the attacker's purposes, that doesn't matter.

Once the LinkedIn account is created, the attacker goes to Slashdot and uses the social login feature, selecting LinkedIn as the identity provider. Identity providers don't pass along a person's credentials to the third party site, but do transfer information such as an email address.

Slashdot.org matches the email address of the victim that was passed to it by LinkedIn to the existing account, allowing the attacker to control the account. The account could then be used to post malicious links, with people believing a trusted contact posted the content.

The researchers cautioned that the attack only works if the victim doesn't already have an account with an identity provider.

There are two flaws in this approach: Slashdot.org shouldn't trust the email address unless the identity provider knows it has been verified, and the identity provider should wait until the email address has been verified.

LinkedIn was vulnerable when it was using the deprecated 1.0a version of the OAuth protocol for social logins. LinkedIn also uses OAuth 2.0, which stops the authentication process if the email address is unverified, they wrote.

But "it's worth mentioning at the time of this writing, the absolute majority of websites we encountered using LinkedIn as a provider were using the 'deprecated' (and vulnerable) version," the researchers wrote.

The researchers found a similar issue with Amazon's "Sign in with Amazon."

"We found that in addition to allowing us to register an account with an email address we don't own and pass it as part of the social login authentication process, it also allowed us to change the Amazon account email address to another unverified address, making it the new account's primary email address," they wrote.

Amazon's security team has since written more documentation on how local accounts should be linked, including verifying emails, they wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags IBMsecurity

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?