{"id":1613,"date":"2016-12-19T02:09:19","date_gmt":"2016-12-19T02:09:19","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=1613"},"modified":"2016-12-29T08:32:50","modified_gmt":"2016-12-29T08:32:50","slug":"%e3%80%90%e6%b4%bb%e5%8a%a8%e9%a2%84%e5%91%8a%e3%80%91-%e7%94%b0%e5%9b%ad%ef%bc%9a-mobile-oauth%e7%9a%84%e4%b8%80%e5%8d%83%e7%a7%8d%e6%ad%bb%e6%b3%95","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=1613","title":{"rendered":"\u3010\u6d3b\u52a8\u9884\u544a\u3011 \u7530\u56ed\uff1a Mobile OAuth\u7684\u4e00\u5343\u79cd\u6b7b\u6cd5\u2014\u2014OAuth\u79fb\u52a8\u5e94\u7528\u5b89\u5168\u5206\u6790"},"content":{"rendered":"

\u62a5\u544a\u9898\u76ee\uff1a\u00a0Mobile OAuth\u7684\u4e00\u5343\u79cd\u6b7b\u6cd5<\/strong><\/p>\n

\u6f14\u8bb2\u4eba\uff1a\u00a0\u7530\u56ed\u00a0\u00a0\u5361\u5185\u57fa\u6885\u9686\u5927\u5b66\u00a0\u535a\u58eb\u751f<\/strong><\/p>\n

\u65f6\u95f4\uff1a12\u670823\u65e5(\u5468\u4e94)\u4e0a\u534810:00~11:00<\/strong><\/p>\n

\u5730\u70b9\uff1a\u6e05\u534e\u5927\u5b66FIT\u697c 3-225<\/strong><\/p>\n

<\/p>\n

\u62a5\u544a\u6458\u8981\uff1a<\/strong><\/p>\n

OAuth\u662f\u4e00\u79cd\u5728\u4e1a\u754c\u975e\u5e38\u6d41\u884c\u7684\u5b89\u5168\u534f\u8bae\u3002\u7136\u800c\uff0c\u5f53\u6b64\u534f\u8bae\u88ab\u5e7f\u6cdb\u5e94\u7528\u4e8e\u79fb\u52a8\u5e94\u7528\u9886\u57df\u4ee5\u53ca\u8ba4\u8bc1\u670d\u52a1\u65f6\uff0c\u4f1a\u5e26\u6765\u5f88\u591a\u4e25\u91cd\u7684\u5b89\u5168\u95ee\u9898\uff0c\u5bfc\u81f4\u7528\u6237\u8d26\u53f7\u53ca\u4fe1\u606f\u7684\u6cc4\u6f0f\u3002\u6211\u4eec\u5bf9\u5f53\u524d\u79fb\u52a8\u9886\u57df\u7684OAuth\u5e94\u7528\u8fdb\u884c\u4e86\u7cfb\u7edf\u6df1\u5165\u7684\u7814\u7a76\uff0c\u53d1\u73b0\u8fd160%\u7684\u79fb\u52a8\u5e94\u7528\u90fd\u5b58\u5728\u81f3\u5c11\u4e00\u79cdOAuth\u5b89\u5168\u95ee\u9898\u3002\u6211\u4eec\u7684\u7814\u7a76\u5f97\u5230\u4e86\u5382\u5bb6\u7684\u5e7f\u6cdb\u8ba4\u53ef\u3002\u6b64\u6b21\u6f14\u8bb2\u5c06\u5bf9\u5178\u578b\u7684\u79fb\u52a8OAuth\u5b89\u5168\u95ee\u9898\u8fdb\u884c\u6848\u4f8b\u5206\u6790\uff0c\u5e76\u4e14\u63d0\u4f9b\u76f8\u5e94\u7684\u5b89\u5168\u5efa\u8bae\u3002<\/p>\n

\u6f14\u8bb2\u4eba\u7b80\u4ecb\uff1a<\/strong><\/p>\n

\"yuan_tian-1\"<\/p>\n

\u7530\u56ed\u662f\u5361\u5185\u57fa\u6885\u9686\u5927\u5b66\u535a\u58eb\u751f\uff0c\u5979\u7684\u7814\u7a76\u5174\u8da3\u5728\u4e8e\u7cfb\u7edf\u5b89\u5168\u548c\u5b89\u5168\u53ef\u7528\u6027\u3002\u5979\u76ee\u524d\u7684\u7814\u7a76\u4e13\u6ce8\u4e8e\u79fb\u52a8\u5b89\u5168\u548c\u7269\u8054\u7f51\u5b89\u5168\u3002 \u5979\u7684\u5b89\u5168\u7814\u7a76\u66fe\u53d1\u8868\u4e8eOakland\u3001CCS\u3001NDSS\u7b49\u4f1a\u8bae\u4e0a\uff0c \u5e76\u88ab\u591a\u5bb6\u4e1a\u754c\u516c\u53f8\u91c7\u7528\uff0c\u6bd4\u5982\u8c37\u6b4c\uff0c\u8138\u4e66\uff0c\u4e09\u661f\uff0c Dropbox\u7b49\u3002\u5979\u66fe\u83b7\u5f97\u7f8e\u56fd\u7535\u5b50\u4e0e\u8ba1\u7b97\u673a\u9886\u57df2016\u5e74\u5ea6\u5b66\u672f\u65b0\u661f\uff0c IBM\u5956\u5b66\u91d1\u7b49\u8363\u8a89\u3002\u5979\u66fe\u5728\u5fae\u8f6f\u7814\u7a76\u9662\uff0c\u8138\u4e66\uff0c\u4e09\u661f\u7814\u7a76\u9662\u7b49\u5b9e\u4e60\uff0c\u5e76\u66fe\u662f\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u4e0e\u4fe1\u606f\u5b89\u5168\u5b9e\u9a8c\u5ba4\u7684\u4e00\u5458\u3002<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n

Speaker: Yuan Tian, Ph.D. candidate in Carnegie Mellon University<\/strong><\/p>\n

Title: 1000 Ways to Die in Mobile OAuth<\/strong><\/p>\n

Abstract:<\/strong><\/p>\n

OAuth has become a highly influential protocol due to its swift and wide adoption in the industry. The initial objective of the protocol was specific: it serves the authorization needs for websites. However, the protocol is repurposed for mobile applications and authentication in practice. We conduct an in-depth about OAuth for mobile application, and the result is really worrisome: among the 149 applications that use OAuth, 89 of them (59.7%) were incorrectly implemented and thus vulnerable. Our study is acknowledged by many companies, including Facebook and Dropbox. In this talk, I’ll show several representative cases to concretely explain how real implementations fell into these pitfalls, and also pinpoint the key portions in each OAuth protocol flow that are security critical.<\/p>\n

Bio:<\/strong><\/p>\n

Yuan is a Ph.D candidate at Carnegie Mellon University. Her research interests involve security and privacy and its interactions with system, networking, and human-computer interaction. Her current research focuses on developing new technologies for protecting user privacy, particularly in the areas of mobile systems and Internet of Things. Her previous work about mobile and web security and privacy have been adopted by Google, Facebook, Microsoft, Samsung, Dropbox and others. She interned at Microsoft Research, Facebook, and Samsung Research, and NISL at Tsinghua University. She was awarded as Rising Stars in EECS 2016, Black Hat Future Female Leaders 2015. She was a recipient of IBM Fellowship and in the final list of Microsoft Research Fellowship and Qualcomm Innovation Fellowship.<\/p>\n

\u89c6\u9891\u76f4\u64ad\u5165\u53e3<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\u62a5\u544a\u9898\u76ee\uff1a\u00a0Mobile OAuth\u7684\u4e00\u5343\u79cd\u6b7b\u6cd5 \u6f14\u8bb2\u4eba\uff1a\u00a0\u7530\u56ed\u00a0\u00a0\u5361\u5185\u57fa\u6885\u9686\u5927\u5b66\u00a0\u535a\u58eb\u751f \u65f6\u95f4\uff1a1… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1613","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1613"}],"version-history":[{"count":5,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1613\/revisions"}],"predecessor-version":[{"id":1622,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1613\/revisions\/1622"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1613"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}