Bypassing Third-Party Login Platform Authentication for Mobile Apps

Third-party authorization simplifies the registration and login process for new applications or websites by allowing users to utilize their existing third-party accounts. Third-party platforms have integrated their own login functionality code into SDK for developers to use. However, these SDKs, if poorly designed, can lead to security issues. Attackers may exploit available information in conjunction with design flaws in the SDKs to launch attacks, posing a significant threat to user privacy. The paper further investigates the security of OAuth services in SDKs, building on previous attack methods. Our experiments show that, despite updates to app hardening techniques, these attacks remain effective, highlighting the limitations of current defenses. The attack we mentioned enables successful account hijacking, which we demonstrated using Weibo as a case study. To understand the scope of this attack, we evaluated the top 1000 apps by download volume in the Xiaomi app store and found that 26% of these apps are vulnerable to our attack. Subsequently, we explored the potential hazards of this model and combining existing issues with defensive strategies, further refined preventive measures against such threats. Based on this phenomenon, we have conducted further research into the security of OAuth services as implemented within SDK, proposing a new threat model for third-party logins via web authorization.