Главная
Study mode:
on
1
Introduction
2
About Me
3
Agenda
4
SSO
5
SAML
6
XML
7
Name ID
8
Attributes
9
Signature
10
XML Digital Signature
11
XML Canonicalization
12
XML Comments
13
Saml API
14
XML API
15
XML Documents as Trees
16
Is XML Broken
17
What We Know
18
The Timeline
19
How could this be exploited
20
Threat Model
21
Truncation Vulnerability
22
SAML Assertion
23
Update Profile Information
24
Remediation
25
Exploit Steps
26
Programmable Identity
27
One More Trick
28
HighLevel Steps
29
Conclusion
30
Shoutouts
Description:
Explore a critical vulnerability affecting SAML-based Single Sign-On (SSO) systems in this 41-minute Black Hat conference talk. Delve into the technical details of XML signatures, SAML implementations, and their potential security flaws. Learn about the discovery process, timeline, and implications of this vulnerability that impacts multiple libraries underpinning many SSO systems. Understand the threat model, exploitation techniques, and remediation strategies for the truncation vulnerability in SAML assertions. Gain insights into programmable identity and additional tricks that can compromise SSO security. Suitable for security professionals and developers working with SSO systems.

Identity Theft - Attacks on SSO Systems

Black Hat
Add to list
0:00 / 0:00