Android系统中第三方登陆漏洞与解决方案

发布时间：2018-05-09 08:21

本文选题：第三方登陆 + OAuth　；参考：《西安电子科技大学》2014年硕士论文

【摘要】：随着科技的发展,移动终端得到了广泛普及,在移动终端所使用的手机操作系统中,Android操作系统由于其开源、免费、定制度高等优点而被各大移动终端生产厂商所采用。Android操作系统的广泛应用,也使得移动智能终端市场得到了快速的发展。用户在使用Android操作系统时,通过简单的学习即可轻松掌握,通过Android操作系统,用户可以方便的接入移动互联网,快速获取实时新闻消息等,也能使用众多互联网厂商所提供的优质服务。现如今,众多互联网厂商已不仅仅提供基础服务,而是希望能够与其他开发商共享数据,共同为用户提供更良好的用户体验。因此,众多互联网厂商在Android操作系统平台上提供了第三方登陆服务,使用户在使用其他应用时可以不需要注册新的账号,而采用第三方登陆服务商提供的登陆授权机制进行快速接入,这大大提升了用户使用新应用时的体验。然而,众多厂商所提供的第三方登陆服务可能存在安全性隐患,一旦其被恶意应用利用,会对用户隐私造成极大威胁。针对此类问题,本文对腾讯、新浪等公司所提供的第三方登陆服务进行反编译分析,破解其登陆认证流程,发现其中存在的漏洞,并对其中漏洞完成利用并获取用户权限,腾讯、新浪公司也确认了漏洞的存在。经过对漏洞的深入研究,本文分别针对第三方登陆服务SSO、Web登陆方式提出并实现了解决方案,并从有效性、性能、兼容性三个方面对解决方案进行了评估,得出解决方案能够较好的解决上述攻击的结论。
[Abstract]:With the development of science and technology, mobile terminals have been widely popularized. The Android operating system is free of charge because of its open source in the mobile operating system used by mobile terminals. Because of the advantages of high fixed system, the Android operating system is widely used by all the major mobile terminal manufacturers, which makes the mobile intelligent terminal market develop rapidly. When using the Android operating system, users can easily master it through simple learning. Through the Android operating system, users can easily access the mobile Internet, quickly obtain real-time news, etc. Can also use numerous Internet manufacturers to provide quality services. Today, many Internet vendors not only provide basic services, but also hope to share data with other developers to provide users with a better user experience. As a result, many Internet vendors have provided third-party login services on the Android operating system platform, allowing users to register new accounts without having to use other applications. Using the login authorization mechanism provided by the third party login service provider, it greatly improves the user's experience when using the new application. However, many third-party login services provided by many vendors may have security risks, once they are used by malicious applications, they will pose a great threat to the privacy of users. In view of this kind of problem, this article carries on the decompilation analysis to the third party login service provided by Tencent, Sina and so on, deciphers its login authentication process, discovers the flaw existing therein, and completes the exploitation and obtains the user authority to the flaw. Tecent, Sina company also confirmed the existence of loophole. Through the in-depth study of the vulnerability, this paper proposes and implements the solution for the third-party login service SSON Web login, and evaluates the solution from three aspects: effectiveness, performance and compatibility. The conclusion that the solution can better solve the above attack.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08;TP316

【相似文献】