'SpoofedMe' attacks exploited LinkedIn, Amazon social login flaws

IBM found several problems in how login credentials can be used for other websites

IBM's X Force security researchers found an easy way to gain access to Web accounts by taking an advantage of an oversight in how some social login services are configured.

Those services allow someone to login to a Web service using, for example, their LinkedIn credentials. It's a convenient way for users to create new accounts on websites by using existing information.

But in one instance, the researchers found they could gain control of accounts at Slashdot.org, Nasdaq.com, Crowdfunder.com and others by abusing LinkedIn's social login mechanism.

Other identity services were also found to be vulnerable to the "SpoofedMe" attack, wrote Or Peles and Roee Hay of IBM Security Systems.

LinkedIn, Amazon and Vasco, all identity providers, have all either fixed or taken measures to prevent such account takeovers, after notification from IBM, the researchers said. But the problem is one that both identity providers and third-party websites using those services should be aware of.

The attack that abuses LinkedIn is demonstrated in a video included in a blog post. The attacker creates an account with LinkedIn, using the victim's email address.

LinkedIn will send a verification email to the victim to ensure the person has control over the address. But for the attacker's purposes, that doesn't matter.

Once the LinkedIn account is created, the attacker goes to Slashdot and uses the social login feature, selecting LinkedIn as the identity provider. Identity providers don't pass along a person's credentials to the third party site, but do transfer information such as an email address.

Slashdot.org matches the email address of the victim that was passed to it by LinkedIn to the existing account, allowing the attacker to control the account. The account could then be used to post malicious links, with people believing a trusted contact posted the content.

The researchers cautioned that the attack only works if the victim doesn't already have an account with an identity provider.

There are two flaws in this approach: Slashdot.org shouldn't trust the email address unless the identity provider knows it has been verified, and the identity provider should wait until the email address has been verified.

LinkedIn was vulnerable when it was using the deprecated 1.0a version of the OAuth protocol for social logins. LinkedIn also uses OAuth 2.0, which stops the authentication process if the email address is unverified, they wrote.

But "it's worth mentioning at the time of this writing, the absolute majority of websites we encountered using LinkedIn as a provider were using the 'deprecated' (and vulnerable) version," the researchers wrote.

The researchers found a similar issue with Amazon's "Sign in with Amazon."

"We found that in addition to allowing us to register an account with an email address we don't own and pass it as part of the social login authentication process, it also allowed us to change the Amazon account email address to another unverified address, making it the new account's primary email address," they wrote.

Amazon's security team has since written more documentation on how local accounts should be linked, including verifying emails, they wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags IBMsecurity

More about Security SystemsSlashdot.orgVasco

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place