5 ms·

> Good luck, it's prolific throughout so many enterprises and academic institutions. Peasy easy. Just start mounting SAML vulnerabilities attacks on all those

by avmich 5y ago

> Good luck, it's prolific throughout so many enterprises and academic institutions. Peasy easy. Just start mounting SAML vulnerabilities attacks on all those organizations with friendly suggestions to fix their problems, on top of juicy demonstrations of dangers. After a few will be affected, a trend will appear - in all kinds of media, among other things - that one ought to move from SAML. Of course the teachings should be done remotely, from friendly jurisdictions. /s We have this problem with security for years, not, decades even. Vista (Microsoft OS) was universally hated - <appropriate xkcd picture with blinking Hitler inserted> - as it tried to address gaping holes in XP security; fortunately Win 7 was much more user-friendly, so security still had some wins. But not nearly "ultimate" wins, no.

tptacek 5y ago
The problem is that while we're all pretty sure there are more grave SAML vulnerabilities, they're not super easy to find. You can't just read this blog post and then go attack a SAML system; finding SAML bugs is actual research.
- distortedsignal 5y ago
  Is that... true? I've got a moderate SAML background - written a few SAML services. What sort of attacks (or attack ideas) would you need a research background on in order to judge whether an attack is valid? As an example, one of my projects has pretty good unit/integration test coverage, and the integrations always confirm that the SAML SP will accept/reject valid/invalid assertions. Seems like it would be pretty easy to spin up a REPL and run a bunch of example docs against the service.
  - tptacek 5y ago
    The audience checking authorization vulnerability is a simple example of something that test suites don't tend to cover. Case in point: there's an example of a SAML library on this thread that doesn't even know about audience restrictions.
tandr 5y ago
(for a reference to "appropriate xkcd picture with blinking Hitler inserted" - https://xkcd.com/528/ https://xkcd.com/528/ )

by avmich 5y ago

tptacek 5y ago

The problem is that while we're all pretty sure there are more grave SAML vulnerabilities, they're not super easy to find. You can't just read this blog post and then go attack a SAML system; finding SAML bugs is actual research.

distortedsignal 5y ago
Is that... true? I've got a moderate SAML background - written a few SAML services. What sort of attacks (or attack ideas) would you need a research background on in order to judge whether an attack is valid? As an example, one of my projects has pretty good unit/integration test coverage, and the integrations always confirm that the SAML SP will accept/reject valid/invalid assertions. Seems like it would be pretty easy to spin up a REPL and run a bunch of example docs against the service.
- tptacek 5y ago
  The audience checking authorization vulnerability is a simple example of something that test suites don't tend to cover. Case in point: there's an example of a SAML library on this thread that doesn't even know about audience restrictions.

tandr 5y ago

(for a reference to "appropriate xkcd picture with blinking Hitler inserted" - https://xkcd.com/528/ https://xkcd.com/528/ )