Re: [GNAP] Defense protection

Correct me if I'm mistaken, it sounds like the Golden SAML attack amounts
to getting control of the signer's private key. I'm going to go out on a
limb here and say, I'm not sure any protocol solution would help solve this
problem. But I would love to be mistaken. It's possible to make this harder
by allowing multiparty signers to be required (or at least allowed/enabled)
to prevent single vulnerable issues. There are other issues with that sort
of solution, such as then requiring more nodes to sign each request and
thus providing more physical attack surfaces. It's hard for me to evaluate
the trade off there.

In the case of the OAuth article it seems to suggest, phishing is the
problem. The solution here is preventing the user from entering their
"password" in malicious locations. I'm hoping that browsers will better
support first-class login apis and sanitization for better protection here,
however, nothing first comes to mind about what protocol could do to stop
that. I would say here, browsers need to get better, device OSs need to be
better. Maybe there are better solutions lurking out there.

Warren Parad

Founder, CTO
Secure your user data with IAM authorization as a service. Implement
Authress <https://authress.io/>.

On Fri, May 28, 2021 at 9:51 PM Kathleen Moriarty <
kathleen.moriarty.ietf@gmail.com> wrote:

> Hi Adrian,
>
> Thanks for your interest!
>
> This is a helpful link that describes how the attackers were able to
> bypass MFA by stealing the signing key for SAML assertions:
>
> https://www.darkreading.com/attacks-breaches/solarwinds-campaign-focuses-attention-on-golden-saml-attack-vector/d/d-id/1339794
>
> https://owasp.org/www-chapter-singapore/assets/presos/Deconstructing_the_Solarwinds_Supply_Chain_Attack_and_Deterring_it_Honing_in_on_the_Golden_SAML_Attack_Technique.pdf
>
> I did read one that was a bit better, but can't find the link at the
> moment.
>
> And one on shared OAuth credentials/token issuance:
>
> https://www.csoonline.com/article/3607348/how-to-defend-against-oauth-enabled-cloud-based-attacks.html
>
> It would be good to think about attack vectors and if not prevention,
> minimally detection.
>
> Best regards,
> Kathleen
>
> On Fri, May 28, 2021 at 3:41 PM Adrian Gropper <agropper@healthurl.com>
> wrote:
>
>> Hi Kathleen,
>>
>> I am not aware of the attacks on SAML and OAuth and would appreciate a
>> link or two.
>>
>> I hope we can provide guidance on how GNAP can facilitate Zero Trust
>> Architecture and believe that includes guidance on how to audit various
>> things as systems use GNAP protocols to separate concerns among independent
>> actors.
>>
>> Count me in for a brainstorming sessio,
>>
>> - Adrian
>>
>>
>> On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <
>> kathleen.moriarty.ietf@gmail.com> wrote:
>>
>>> Hello!
>>>
>>> In light of recent attacks against SAML and OAuth, I'd like to see what
>>> defense mechanisms and detection could be built into the spec.  One example
>>> would be from the recent SAML attack.  If there was a detection of
>>> instances of authorization without authentication, the SAML attack used in
>>> SolarWinds might have been detected sooner.
>>>
>>> If you think along the lines of fraud detection, where you detect
>>> unusual events, there may be some specific to GNAP that could enable early
>>> detection of abuse, misuse, or exploits.
>>>
>>> Are there some planned?  Would people like to brainstorm on this?
>>> Thanks!
>>>
>>>
>>> --
>>>
>>> Best regards,
>>> Kathleen
>>> --
>>> TXAuth mailing list
>>> TXAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/txauth
>>>
>>
>
> --
>
> Best regards,
> Kathleen
> --
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>