I Am Whoever I Say I Am: Infiltrating Identity Providers Using a 0Click Exploit
Analyzes practitioners Am Whoever practitioners Say practitioners Am: Infiltrating Identity Providers Using a 0Click Exploit and evaluates key implications for security practitioners.
Summary
Overview: Tamir Zahavi-Brunner, a security researcher with the Vulnerability Research Institute at Qihoo 360, demonstrates a critical class of zero-click exploits targeting enterprise Single Sign-On (SSO) identity providers. The presentation explores architectural oversights in SAML and OAuth implementations where trust relationships between service providers and identity providers can be subverted without requiring victim interaction. Zahavi-Brunner outlines how improper assertion validation enables complete authentication bypass across major identity platforms.
Key Topics: - SAML XML signature wrapping and assertion canonicalization flaws - Flaws in OAuth 2.0 and OpenID Connect token verification workflows - Exploiting zero-click account takeovers across federated enterprise authentication - Hardening identity federation mechanisms and automated protocol verification
Technical Details: The research examines the underlying mechanics of Security Assertion Markup Language (SAML) parsing within enterprise identity providers and service providers. Zahavi-Brunner explains how disparate XML parsers evaluate XML Signature definitions inconsistently, creating opportunities for XML Signature Wrapping (XSW) attacks. By cloning a legitimate signed assertion and inserting an untrusted, modified assertion within cloned DOM structures, attackers trick identity processors into validating the cryptographic signature of the benign payload while binding user privileges to the malicious assertion.
The speaker moves beyond classic XSW to expose subtle protocol flaws in modern OAuth 2.0 and OpenID Connect (OIDC) integrations. Specifically, certain identity providers accept claims derived from third-party identity brokers without enforcing cryptographic binding to the issuing authorization server. By constructing crafted redirect URLs and abusing state parameter handling, an adversary can force an identity provider to link an attacker-controlled identity token to a legitimate victim account. Because these requests execute through background API interactions or automated browser redirects, the attack requires zero clicks or interaction from the target victim.
Key Takeaways: Enterprise organizations and identity developers must ensure that XML and JSON signature verification routines operate strictly on canonicalized, unambiguously referenced payload elements. Service providers should mandate strict issuer verification, cryptographically bound nonce values, and state validation on all OAuth and SAML callback endpoints. Furthermore, security teams should implement continuous monitoring for anomalous token issuance patterns and unexpected identity broker mappings across enterprise SSO infrastructure.
(AI summary — Gemini Flash)
Related talks
Black Hat USA 2022·23 min
Tal Garfinkel · Shravan Narayan · Deian Stefan
Explores how Firefox Uses In-process Sandboxing To Protect Itself From Exploitable Libraries and evaluates key implications for security practitioners.
Black Hat USA 2022·35 min
Christopher Cole · Farzan Karimi · Eugene Rodionov · Xuan Xing
Presents google Reimagined a Phone. It was enterprise Job to Red Team and Secure it and evaluates key implications for security practitioners.
Village Interviews·5 min
The DEF CON Video Team tours the Physical Security Village to check out lock bypass stations, door access mechanisms, and safe manipulation challenges.