Subject: [GNAP] Defense protection

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 28 May 2021 15:28:44 -0400

Hello!

In light of recent attacks against SAML and OAuth, I'd like to see what
defense mechanisms and detection could be built into the spec.  One example
would be from the recent SAML attack.  If there was a detection of
instances of authorization without authentication, the SAML attack used in
SolarWinds might have been detected sooner.

If you think along the lines of fraud detection, where you detect unusual
events, there may be some specific to GNAP that could enable early
detection of abuse, misuse, or exploits.

Are there some planned?  Would people like to brainstorm on this?
Thanks!

-- 

Best regards,
Kathleen

---

From: Adrian Gropper <[email-masked]>
Date: Fri, 28 May 2021 15:41:46 -0400

Hi Kathleen,

I am not aware of the attacks on SAML and OAuth and would appreciate a link
or two.

I hope we can provide guidance on how GNAP can facilitate Zero Trust
Architecture and believe that includes guidance on how to audit various
things as systems use GNAP protocols to separate concerns among independent
actors.

Count me in for a brainstorming sessio,

- Adrian

On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <
[email-masked]> wrote:

> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 28 May 2021 15:50:43 -0400

Hi Adrian,

Thanks for your interest!

This is a helpful link that describes how the attackers were able to bypass
MFA by stealing the signing key for SAML assertions:
https://www.darkreading.com/attacks-breaches/solarwinds-campaign-focuses-attention-on-golden-saml-attack-vector/d/d-id/1339794
https://owasp.org/www-chapter-singapore/assets/presos/Deconstructing_the_Solarwinds_Supply_Chain_Attack_and_Deterring_it_Honing_in_on_the_Golden_SAML_Attack_Technique.pdf

I did read one that was a bit better, but can't find the link at the moment.

And one on shared OAuth credentials/token issuance:
https://www.csoonline.com/article/3607348/how-to-defend-against-oauth-enabled-cloud-based-attacks.html

It would be good to think about attack vectors and if not prevention,
minimally detection.

Best regards,
Kathleen

On Fri, May 28, 2021 at 3:41 PM Adrian Gropper <[email-masked]>
wrote:

> Hi Kathleen,
>
> I am not aware of the attacks on SAML and OAuth and would appreciate a
> link or two.
>

-- 

Best regards,
Kathleen

---

From: Warren Parad <[email-masked]>
Date: Fri, 28 May 2021 22:02:47 +0200

Correct me if I'm mistaken, it sounds like the Golden SAML attack amounts
to getting control of the signer's private key. I'm going to go out on a
limb here and say, I'm not sure any protocol solution would help solve this
problem. But I would love to be mistaken. It's possible to make this harder
by allowing multiparty signers to be required (or at least allowed/enabled)
to prevent single vulnerable issues. There are other issues with that sort
of solution, such as then requiring more nodes to sign each request and
thus providing more physical attack surfaces. It's hard for me to evaluate
the trade off there.

In the case of the OAuth article it seems to suggest, phishing is the
problem. The solution here is preventing the user from entering their
"password" in malicious locations. I'm hoping that browsers will better
support first-class login apis and sanitization for better protection here,
however, nothing first comes to mind about what protocol could do to stop
that. I would say here, browsers need to get better, device OSs need to be
better. Maybe there are better solutions lurking out there.

Warren Parad

Founder, CTO
Secure your user data with IAM authorization as a service. Implement
Authress <https://authress.io/>.

On Fri, May 28, 2021 at 9:51 PM Kathleen Moriarty <
[email-masked]> wrote:

> This is a helpful link that describes how the attackers were able to
> bypass MFA by stealing the signing key for SAML assertions:
>
>>> If you think along the lines of fraud detection, where you detect
>>> unusual events, there may be some specific to GNAP that could enable early

---

From: Adrian Gropper <[email-masked]>
Date: Fri, 28 May 2021 16:09:28 -0400

Thanks to Alan Karp, I have come to believe that delegation is essential
and GNAP needs to speak of capabilities as first-class tokens and encourage
their use.  This will become the main driver for adoption of GNAP over SAML
or OAuth.

- Adrian

---

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 28 May 2021 16:44:05 -0400

Warren,

We can think about advice on detection and having that be built into the
security considerations.  There is a clear example given in the SAML case.
I'm raising this as food for thought and to see what we can do.  Security
needs to be better, more scalable, and easier on the user base.  That's not
a simple combination.  These attacks are only a sample of what is to come.
If there is a vulnerability or a blind spot, it will be used.

Best regards,
Kathleen

-- 

Best regards,
Kathleen

---

From: Alan Karp <[email-masked]>
Date: Fri, 28 May 2021 22:45:45 -0700

> their use.  This will become the main driver for adoption of GNAP over SAML

I would say attenuated delegation instead of just delegation.  Revocation
is important, too.

--------------
Alan Karp

---

From: Cendyne <[email-masked]>
Date: Sat, 29 May 2021 10:01:22 -0500

Alan,

What does attenuated delegation mean and entail?
I am not finding a definitive definition online.

> On May 29, 2021, at 12:46 AM, Alan Karp <[email-masked]> wrote:
> 
> 
>> On Fri, May 28, 2021 at 1:09 PM Adrian Gropper <[email-masked]> wrote:
>> Thanks to Alan Karp, I have come to believe that delegation is essential and GNAP needs to speak of capabilities as first-class tokens and encourage their use.  This will become the main driver for adoption of GNAP over SAML or OAuth. 
> 
> I would say attenuated delegation instead of just delegation.  Revocation is important, too.
> 
> --------------
> Alan Karp
> 
> 
>> On Fri, May 28, 2021 at 1:09 PM Adrian Gropper <[email-masked]> wrote:
>> Thanks to Alan Karp, I have come to believe that delegation is essential and GNAP needs to speak of capabilities as first-class tokens and encourage their use.  This will become the main driver for adoption of GNAP over SAML or OAuth. 
>> 
>> - Adrian
>> 
>> 
>> 
>>> On Fri, May 28, 2021 at 3:51 PM Kathleen Moriarty <[email-masked]> wrote:
>>> Hi Adrian,
>>> 
>>> This is a helpful link that describes how the attackers were able to bypass MFA by stealing the signing key for SAML assertions:
>>> It would be good to think about attack vectors and if not prevention, minimally detection.
>>> 
>>> Best regards,
>>> Kathleen
>>> 
>>>> On Fri, May 28, 2021 at 3:41 PM Adrian Gropper <[email-masked]> wrote:
>>>> Hi Kathleen,
>>>> 
>>>> I am not aware of the attacks on SAML and OAuth and would appreciate a link or two.
>>>> 
>>>> I hope we can provide guidance on how GNAP can facilitate Zero Trust Architecture and believe that includes guidance on how to audit various things as systems use GNAP protocols to separate concerns among independent actors. 
>>>> 
>>>>> On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <[email-masked]> wrote:
>>>>> Hello!
>>>>> 
>>>>> In light of recent attacks against SAML and OAuth, I'd like to see what defense mechanisms and detection could be built into the spec.  One example would be from the recent SAML attack.  If there was a detection of instances of authorization without authentication, the SAML attack used in SolarWinds might have been detected sooner.
>>>>> 
>>>>> If you think along the lines of fraud detection, where you detect unusual events, there may be some specific to GNAP that could enable early detection of abuse, misuse, or exploits.
>>>>>