Ripping OAuth tokens out of Twitter apps

#1

Post by sferik » Mon, Aug 20, 2012, 11:47 PM UTC

Ripping OAuth tokens out of Twitter apps
timetobleed.com

Re: Ripping OAuth tokens out of Twitter apps

#2

Post by uncoder0 » Tue, Aug 21, 2012, 12:32 AM UTC

This operation is awesome and it does a great job of showing how twitter is going to have a hard time having blessed clients. If twitter wants to rate limit API calls for apps in an effort to reduce abuse then abusers are going to impersonate the official twitter client.

Re: Ripping OAuth tokens out of Twitter apps

#3

Post by eridius » Tue, Aug 21, 2012, 12:39 AM UTC

The printed output strings look like HTTPS requests. Wouldn't it have just been simpler to use Charles to run an SSL MitM attack? I highly doubt these twitter clients check what certificate they're using beyond whether it's trusted.

Re: Ripping OAuth tokens out of Twitter apps

#4

Post by wheels » Tue, Aug 21, 2012, 1:13 AM UTC

You can often find things even more simply if they're just embedded in the binary and you know what format you're looking for.

This, for example, goes fishing for MD5 hashes:

  /Applications> find *.app/Contents/MacOS -maxdepth 1 -perm 755 -type f -print0 | \
    xargs -0 strings | grep '^[0-9a-f]\{32\}$'

Re: Ripping OAuth tokens out of Twitter apps

#5

Post by armooo » Tue, Aug 21, 2012, 1:31 AM UTC

I pulled the keys out of the android client this weekend. Not as good of a write up, but I used apktool to convert the APK back to xml resource files and smali dalvik assembler. Greped for Hmac and added some logging. Did the same thing for oauth_consumer_key. Rebuilt it as an APK with apktool. Signed it with jarsigner. Watched the logs and logged in. I think the best part is this key can use xauth so other clients can have the nicer UX of the official client.

    invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    move-result-object v0

    invoke-virtual {v0}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v0

    // Added logging
    const-string v1, "PrivateKey"
    invoke-static {v1, v0}, Landroid/util/Log;->d(Ljava/lang/String;Ljava/lang/String;)I

    const-string v1, "UTF8"

    invoke-virtual {v0, v1}, Ljava/lang/String;->getBytes(Ljava/lang/String;)[B

    move-result-object v0

    new-instance v1, Ljavax/crypto/spec/SecretKeySpec;

    const-string v2, "HmacSHA1"

    invoke-direct {v1, v0, v2}, Ljavax/crypto/spec/SecretKeySpec;->([BLjava/lang/String;)V


  D/PrivateKey(18590): XXXXXX
  D/Auth Header(18590): OAuth realm="http://api.twitter.com/", oauth_version="1.0", oauth_nonce="2404904914329321765488437936138011", oauth_timestamp="1345512606", oauth_signature="gEvQOcGWO7aPCYTemRy%2BkYH3oFM%3D", oauth_consumer_key="3nVuSoBZnx6U4vzUxf5w", oauth_signature_method="HMAC-SHA1"

Re: Ripping OAuth tokens out of Twitter apps

#6

Post by armooo » Tue, Aug 21, 2012, 1:39 AM UTC

eridius wrote: post #3

The printed output strings look like HTTPS requests. Wouldn't it have just been simpler to use Charles to run an SSL MitM attack? I highly doubt these twitter clients check what certificate they're using beyond whether it's trusted.

OAuth was designed to not require SSL. So only the oauth_consumer_key, which works as an client id, is sent over the wire. HMAC-SHA1 is then used with a shared secret key to sign all the requests. This key is what the maloc shim is finding, along with the oauth_consumer_key, but it was simpler at this point then looking at the http connection.

Re: Ripping OAuth tokens out of Twitter apps

#7

Post by slashclee » Tue, Aug 21, 2012, 1:45 AM UTC

I'm surprised he went to the trouble of using `DYLD_INSERT_LIBRARIES` - DTrace makes this sort of thing trivial.... something like:

    #!/usr/sbin/dtrace
    pid$1:$2:free:entry
    {
        printf("%s: %x\n", probefunc, arg0);
    }

would do the trick, I think.

Re: Ripping OAuth tokens out of Twitter apps

#8

Post by dpeck » Tue, Aug 21, 2012, 1:47 AM UTC

armooo wrote: post #5

I pulled the keys out of the android client this weekend. Not as good of a write up, but I used apktool to convert the APK back to xml resource files and smali dalvik assembler. Greped for Hmac and added some logging. Did the same thing for oauth_consumer_key. Rebuilt it as an APK with apktool. Signed it with jarsigner. Watched the logs and logged in. I think the best part is this key can use xauth so other clients c…

are you intentionally neglecting the additional steps to make this work, or did you not test your assumptions against the requests that the app actually sends? ;)

Re: Ripping OAuth tokens out of Twitter apps

#9

Post by eridius » Tue, Aug 21, 2012, 1:49 AM UTC

armooo wrote: post #6

eridius wrote: post #3

The printed output strings look like HTTPS requests. Wouldn't it have just been simpler to use Charles to run an SSL MitM attack? I highly doubt these twitter clients check what certificate they're using beyond whether it's trusted.

OAuth was designed to not require SSL. So only the oauth_consumer_key, which works as an client id, is sent over the wire. HMAC-SHA1 is then used with a shared secret key to sign all the requests. This key is what the maloc shim is finding, along with the oauth_consumer_key, but it was simpler at this point then looking at the http connection.

Ok, then why did the OP only show HTTP requests as the captured output? If he's capturing something else, shouldn't he show that?

Re: Ripping OAuth tokens out of Twitter apps

#10

Post by imrehg » Tue, Aug 21, 2012, 2:01 AM UTC

I was thinking about this quite a few times: doesn't it mean that all this OAuth things are broken from the start, since once you give the binary to the people, the could just get the secret out and reuse it another way?

The TOS of all these APIs all say that "you have to keep your Secret secret, or else!", but fundamentally there's no way to really do that, is there?