Your Software at my Service

Mainka, Christian; Mladenov, Vladislav; Feldmann, Florian; Krautwald, Julian; Schwenk, Jörg

doi:10.1145/2664168.2664172

Cited by 9 publications

(1 citation statement)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For SAML, this is the AssertionConsumerServiceURL parameter [25, Section 3.4.1] which is already evaluated in [26]. In OAuth, the parameter is called redirect_uri [27, Section 4.2.1].…”

Section: Token Recipient Confusionmentioning

confidence: 99%

Do Not Trust Me: Using Malicious IdPs for Analyzing and Attacking Single Sign-on

Mainka

Mladenov

Schwenk

2016

2016 IEEE European Symposium on Security and Privacy (EuroS&P)

Self Cite

View full text Add to dashboard Cite

Abstract. Single Sign-On (SSO) systems simplify login procedures by using an an Identity Provider (IdP) to issue authentication tokens which can be consumed by Service Providers (SPs). Traditionally, IdPs are modeled as trusted third parties. This is reasonable for SSO systems like Kerberos, MS Passport and SAML, where each SP explicitely specifies which IdP he trusts. However, in open systems like OpenID and OpenID Connect, each user may set up his own IdP, and a discovery phase is added to the protocol flow. Thus it is easy for an attacker to set up its own IdP. In this paper we use a novel approach for analyzing SSO authentication schemes by introducing a malicious IdP. With this approach we evaluate one of the most popular and widely deployed SSO protocols -OpenID. We found four novel attack classes on OpenID, which were not covered by previous research, and show their applicability to real-life implementations. As a result, we were able to compromise 11 out of 16 existing OpenID implementations like Sourceforge, Drupal and ownCloud. We automated discovery of these attacks in a open source tool OpenID Attacker, which additionally allows fine-granular testing of all parameters in OpenID implementations. Our research helps to better understand the message flow in the OpenID protocol, trust assumptions in the different components of the system, and implementation issues in OpenID components. It is applicable to other SSO systems like OpenID Connect and SAML. All OpenID implementations have been informed about their vulnerabilities and we supported them in fixing the issues.

show abstract

“…For SAML, this is the AssertionConsumerServiceURL parameter [25, Section 3.4.1] which is already evaluated in [26]. In OAuth, the parameter is called redirect_uri [27, Section 4.2.1].…”

Section: Token Recipient Confusionmentioning

confidence: 99%