Do Not Trust Me: Using Malicious IdPs for Analyzing and Attacking Single Sign-on

Abstract

Abstract. Single Sign-On (SSO) systems simplify login procedures by using an an Identity Provider (IdP) to issue authentication tokens which can be consumed by Service Providers (SPs). Traditionally, IdPs are modeled as trusted third parties. This is reasonable for SSO systems like Kerberos, MS Passport and SAML, where each SP explicitely specifies which IdP he trusts. However, in open systems like OpenID and OpenID Connect, each user may set up his own IdP, and a discovery phase is added to the protocol flow. Thus it is easy for an attacker to set up its own IdP. In this paper we use a novel approach for analyzing SSO authentication schemes by introducing a malicious IdP. With this approach we evaluate one of the most popular and widely deployed SSO protocols -OpenID. We found four novel attack classes on OpenID, which were not covered by previous research, and show their applicability to real-life implementations. As a result, we were able to compromise 11 out of 16 existing OpenID implementations like Sourceforge, Drupal and ownCloud. We automated discovery of these attacks in a open source tool OpenID Attacker, which additionally allows fine-granular testing of all parameters in OpenID implementations. Our research helps to better understand the message flow in the OpenID protocol, trust assumptions in the different components of the system, and implementation issues in OpenID components. It is applicable to other SSO systems like OpenID Connect and SAML. All OpenID implementations have been informed about their vulnerabilities and we supported them in fixing the issues.

Single Sign-On: A Solution Approach to Address Inefficiencies During Sign-Out Process

“…Using protocol analyzing tools, Nair et al identified security vulnerabilities in SSO implementations of Facebook ® , Google ® , and JanRain ® [28]. As part of their research, Mainka et al developed a fully-automated OpenId Attacker tool and used it for ID Spoofing (IDS), Key Confusion (KC), and Token Recipient Confusion (TRC) attacks on several OpenID implementations, including Sourceforge ® , Drupal ® , ownCloud ® and JIRA ® [25]. Shi et al analyzed the vulnerabilities of mobile apps implementation of SSO.…”

A Survey of Security Analysis in Federated Identity Management

“…The first notable thing about the surveyed OpenID papers [17][18][19][20][21][22][23][24][25][26] is how the message formatting (a parameter or part of the message is not signed properly -common in OpenID) vulnerability is exploited by the message modification (possible because the message is not protected properly) attack class for the purposes of compromising a user account. For instance, an adversary could modify parameters such as Openid.ext1.value.email as shown by Wang et al [37].…”

“…Mainka et al [26] pointed out two security incidents at the implementation level which compromised user accounts. The first exploited a lack of binding by launching a MITM attack and had a suggested solution.…”

Assessment of Secure OpenID-Based DAAA Protocol for Avoiding Session Hijacking in Web Applications

“…The main feature of SSO is to enhance the user login process. The SSO is a famous distributed protocol and OpenID supports this protocol [1][2][3][4][5][6][7][8][9][10][11][12][13].…”