AuthProbe: Specification-Driven, Multi-Identity Detection of Broken Object-Level Authorization in Recruitment API

Imagine the internet as a massive, bustling city where every building is a different service, and inside those buildings are millions of tiny, private lockers. Some lockers hold your photos, others hold your job applications, and some hold your medical records. In this city, there are security guards at the doors who check your ID to make sure you belong in the building. But here's the tricky part: just because you have a valid ID to enter the building doesn't mean you have the right to open every locker inside. A "Broken Object-Level Authorization" flaw is like a guard who checks your ID at the front door but then lets you walk down the hallway and open any locker you want, even if it belongs to someone else. This is a huge problem because it means a stranger could sneak in and steal your personal data without breaking any locks or picking any locks; they just ask for it, and the system, confused, says "yes."

For years, security experts have been trying to build better guards. They use "firewalls" that look for known bad guys wearing specific masks, and they use "scanners" that walk through the building pretending to be one person. But these tools often miss the real danger because a thief doesn't need a scary mask or a broken lock; they just need to ask for a locker that isn't theirs while wearing a perfectly valid ID. This paper introduces a new kind of security tester called AuthProbe. Think of AuthProbe not as a single guard, but as a team of spies who can instantly switch identities. They don't just walk through the building once; they walk through as "Alice," see what lockers Alice can open, then instantly switch to "Bob" and try to open Alice's lockers. If Bob can open Alice's locker, the system has a broken authorization flaw, and AuthProbe catches it immediately.

The Paper's Big Idea: The Identity-Switching Detective

The paper presents AuthProbe, a free, open-source tool designed to hunt down these specific security holes in computer systems that handle job applications and recruitment data. The researchers built this tool because they noticed that existing security scanners were failing to catch a very sneaky type of theft.

Here is how AuthProbe works, using a simple analogy: Imagine a library where you can borrow books. A normal security scanner might walk in as "Student A," check out a book, and say, "Okay, Student A can check out books. All clear!" But that scanner doesn't know if Student A is also allowed to check out Student B's reserved book.

AuthProbe is different. It starts by reading the library's official rulebook (called an OpenAPI specification), which lists every type of book and how to ask for them. Then, it brings in two or more "testers" (let's call them Alice and Bob).

1. The Discovery Phase: AuthProbe asks Alice, "What books are in your personal pile?" and records the list. It does the same for Bob. Now it knows exactly which books belong to whom.
2. The Switch: Next, AuthProbe asks Alice to try to check out a book that belongs to Bob.
3. The Proof: If the library system says "Here is Bob's book" to Alice, AuthProbe knows something is wrong. It doesn't just guess; it double-checks by asking Bob to fetch that same book to see what the "real" version looks like. If the book Alice got matches the book Bob owns, AuthProbe has found a Broken Object-Level Authorization (BOLA) leak.

What the Tool Found (and What It Didn't)

The researchers tested AuthProbe on two fake recruitment systems they built in their lab. One system was intentionally broken to mimic a real-world disaster where millions of job applicants had their data exposed. The other system was "hardened," meaning it was fixed with the correct security checks.

• On the Broken System: AuthProbe found every single planted flaw. It successfully showed that "Alice" could read "Bob's" private chat transcripts and contact details. It also found that the system used simple, predictable numbers (like 1, 2, 3) for IDs, which meant a thief could just guess the next number to steal more data.
• On the Fixed System: AuthProbe found zero problems. It tried to steal data, but the system correctly said, "No, you can't see that." This is crucial because it means the tool doesn't cry wolf; it only reports a problem when it is absolutely sure.

The paper also measured how fast the tool works. They tested it with systems holding between 1 and 50 items. The time it took to scan grew in a straight line: as the number of items went up, the time went up proportionally. For example, scanning a system with 50 items took about 114 milliseconds (a tiny fraction of a second). This suggests the tool is fast enough to be used automatically every time a company updates their software, acting like a final safety gate before a new version goes live.

Why This Matters

The paper argues that most current security tools are like guards who only look for people wearing masks or carrying weapons. They miss the person who is wearing a valid uniform but trying to steal a locker that isn't theirs. AuthProbe fixes this by using the "multiple identity" trick. It proves that to catch this specific type of theft, you need to be able to pretend to be two different people at the same time.

The researchers are careful to say that AuthProbe is a black-box tool, meaning it doesn't need to see the computer's internal code to work; it just talks to the system from the outside. This makes it very useful for companies that don't have access to the source code of the software they are using. However, the paper also admits its limits: it can only test the things it can see and name. If a system hides its data lists completely or uses secret, unguessable codes for IDs, AuthProbe might not find anything to test. It is designed to be a partner to other security tools, not a replacement for them.

In short, AuthProbe is a new, automated way to make sure that when you log into a website, you can only see your own data, and no one else's. It turns a complex security problem into a simple, repeatable check that can run automatically, keeping job seekers' private information safe from sneaky thieves who know how to trick the guards.