Re: [GNAP] Defense protection

Hi Kathleen,

Thanks a lot for those insights.

We do have in mind some security analysis indeed, and that will become one
very important working group topic in the coming :

- Security assessment of the protocol
https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/135

We rely on the assumption that private keys can be secured, by whatever
means is necessary.

- Security consideration: warn about the potential for creating phishing
links
https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/255

Certainly it would be great to gather more feedback and analysis from the
group.

Fabien

On Fri, May 28, 2021 at 9:51 PM Kathleen Moriarty <
kathleen.moriarty.ietf@gmail.com> wrote:

> Hi Adrian,
>
> Thanks for your interest!
>
> This is a helpful link that describes how the attackers were able to
> bypass MFA by stealing the signing key for SAML assertions:
>
> https://www.darkreading.com/attacks-breaches/solarwinds-campaign-focuses-attention-on-golden-saml-attack-vector/d/d-id/1339794
>
> https://owasp.org/www-chapter-singapore/assets/presos/Deconstructing_the_Solarwinds_Supply_Chain_Attack_and_Deterring_it_Honing_in_on_the_Golden_SAML_Attack_Technique.pdf
>
> I did read one that was a bit better, but can't find the link at the
> moment.
>
> And one on shared OAuth credentials/token issuance:
>
> https://www.csoonline.com/article/3607348/how-to-defend-against-oauth-enabled-cloud-based-attacks.html
>
> It would be good to think about attack vectors and if not prevention,
> minimally detection.
>
> Best regards,
> Kathleen
>
> On Fri, May 28, 2021 at 3:41 PM Adrian Gropper <agropper@healthurl.com>
> wrote:
>
>> Hi Kathleen,
>>
>> I am not aware of the attacks on SAML and OAuth and would appreciate a
>> link or two.
>>
>> I hope we can provide guidance on how GNAP can facilitate Zero Trust
>> Architecture and believe that includes guidance on how to audit various
>> things as systems use GNAP protocols to separate concerns among independent
>> actors.
>>
>> Count me in for a brainstorming sessio,
>>
>> - Adrian
>>
>>
>> On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <
>> kathleen.moriarty.ietf@gmail.com> wrote:
>>
>>> Hello!
>>>
>>> In light of recent attacks against SAML and OAuth, I'd like to see what
>>> defense mechanisms and detection could be built into the spec.  One example
>>> would be from the recent SAML attack.  If there was a detection of
>>> instances of authorization without authentication, the SAML attack used in
>>> SolarWinds might have been detected sooner.
>>>
>>> If you think along the lines of fraud detection, where you detect
>>> unusual events, there may be some specific to GNAP that could enable early
>>> detection of abuse, misuse, or exploits.
>>>
>>> Are there some planned?  Would people like to brainstorm on this?
>>> Thanks!
>>>
>>>
>>> --
>>>
>>> Best regards,
>>> Kathleen
>>> --
>>> TXAuth mailing list
>>> TXAuth@ietf.org
>>> https://www.ietf.org/mailman/listinfo/txauth
>>>
>>
>
> --
>
> Best regards,
> Kathleen
> --
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>