Re: [GNAP] Defense protection

[Kathleen Moriarty <[e-mail]>]

Warren,

We can think about advice on detection and having that be built into the
security considerations.  There is a clear example given in the SAML case.
I'm raising this as food for thought and to see what we can do.  Security
needs to be better, more scalable, and easier on the user base.  That's not
a simple combination.  These attacks are only a sample of what is to come.
If there is a vulnerability or a blind spot, it will be used.

Best regards,
Kathleen

On Fri, May 28, 2021 at 4:02 PM Warren Parad <[e-mail]> wrote:

> Correct me if I'm mistaken, it sounds like the Golden SAML attack amounts
> to getting control of the signer's private key. I'm going to go out on a
> limb here and say, I'm not sure any protocol solution would help solve this
> problem. But I would love to be mistaken. It's possible to make this harder
> by allowing multiparty signers to be required (or at least allowed/enabled)
> to prevent single vulnerable issues. There are other issues with that sort
> of solution, such as then requiring more nodes to sign each request and
> thus providing more physical attack surfaces. It's hard for me to evaluate
> the trade off there.
>
> In the case of the OAuth article it seems to suggest, phishing is the
> problem. The solution here is preventing the user from entering their
> "password" in malicious locations. I'm hoping that browsers will better
> support first-class login apis and sanitization for better protection here,
> however, nothing first comes to mind about what protocol could do to stop
> that. I would say here, browsers need to get better, device OSs need to be
> better. Maybe there are better solutions lurking out there.
>
> Warren Parad
>
> Founder, CTO
> Secure your user data with IAM authorization as a service. Implement
> Authress <https://authress.io/>.
>
>
> On Fri, May 28, 2021 at 9:51 PM Kathleen Moriarty <
> [e-mail]> wrote:
>
>> Hi Adrian,
>>
>> Thanks for your interest!
>>
>> This is a helpful link that describes how the attackers were able to
>> bypass MFA by stealing the signing key for SAML assertions:
>>
>> https://www.darkreading.com/attacks-breaches/solarwinds-campaign-focuses-attention-on-golden-saml-attack-vector/d/d-id/1339794
>>
>> https://owasp.org/www-chapter-singapore/assets/presos/Deconstructing_the_Solarwinds_Supply_Chain_Attack_and_Deterring_it_Honing_in_on_the_Golden_SAML_Attack_Technique.pdf
>>
>> I did read one that was a bit better, but can't find the link at the
>> moment.
>>
>> And one on shared OAuth credentials/token issuance:
>>
>> https://www.csoonline.com/article/3607348/how-to-defend-against-oauth-enabled-cloud-based-attacks.html
>>
>> It would be good to think about attack vectors and if not prevention,
>> minimally detection.
>>
>> Best regards,
>> Kathleen
>>
>> On Fri, May 28, 2021 at 3:41 PM Adrian Gropper <[e-mail]>
>> wrote:
>>
>>> Hi Kathleen,
>>>
>>> I am not aware of the attacks on SAML and OAuth and would appreciate a
>>> link or two.
>>>
>>> I hope we can provide guidance on how GNAP can facilitate Zero Trust
>>> Architecture and believe that includes guidance on how to audit various
>>> things as systems use GNAP protocols to separate concerns among independent
>>> actors.
>>>
>>> Count me in for a brainstorming sessio,
>>>
>>> - Adrian
>>>
>>>
>>> On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <
>>> [e-mail]> wrote:
>>>
>>>> Hello!
>>>>
>>>> In light of recent attacks against SAML and OAuth, I'd like to see what
>>>> defense mechanisms and detection could be built into the spec.  One example
>>>> would be from the recent SAML attack.  If there was a detection of
>>>> instances of authorization without authentication, the SAML attack used in
>>>> SolarWinds might have been detected sooner.
>>>>
>>>> If you think along the lines of fraud detection, where you detect
>>>> unusual events, there may be some specific to GNAP that could enable early
>>>> detection of abuse, misuse, or exploits.
>>>>
>>>> Are there some planned?  Would people like to brainstorm on this?
>>>> Thanks!
>>>>
>>>>
>>>> --
>>>>
>>>> Best regards,
>>>> Kathleen
>>>> --
>>>> TXAuth mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/txauth
>>>>
>>>
>>
>> --
>>
>> Best regards,
>> Kathleen
>> --
>> TXAuth mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/txauth
>>
>

-- 

Best regards,
Kathleen