Identity Theft: Attacks on SSO Systems
summary
Claims a practical comment truncation class of SAML/XML‑signature bugs that lets an authenticated attacker tamper signed assertions (insert XML comments) so API text extraction truncates NameID/attributes. Researchers test four open‑source libraries then more (including Shibboleth, GitLab), use weaponized unit tests and a small browser HTTP proxy to inject comments, build a demo SAML SP and exploit LastPass Enterprise SSO to prove authentication takeover and privilege escalation — the exploit works end‑to‑end and is recorded.
AI-written summary · about
chapters (5)
- 0:00Start
- 18:08Exploitation of Service Providers
- 19:28SP Exploitability: SAML Authorization Info • Does the SAML Response convey role information? • SAML defines the AttributeStatement element which can contain fairly generic attribute values • This can be used to define role information
- 22:27Exploitation of Identity Providers
- 25:57Mutable Identity increases the impact of comment truncation vulnerabilities.
related talks
45mWhy We Should Kill Saml2
22mSSO Wars: The Token Menace
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
40mModern Single Sign-On: On the Security of Single Sign-On ...
30mInsecurity protocols: an overview of modern authentication
21mVetting Single Sign-On SDK Implementations via Symbolic Reasoning
30mOMG WTF SSO: A Beginner’s Guide to Single Sign-On...
47mThreat Modelling Stories From The Trenches