Subject: Re: [GNAP] Defense protection

From: Fabien Imbault <[email-masked]>
Date: Tue, 1 Jun 2021 14:43:52 +0200

Hi Kathleen,

Thanks a lot for those insights.

We do have in mind some security analysis indeed, and that will become one
very important working group topic in the coming :

- Security assessment of the protocol
https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/135

We rely on the assumption that private keys can be secured, by whatever
means is necessary.

- Security consideration: warn about the potential for creating phishing
links
https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/255

Certainly it would be great to gather more feedback and analysis from the
group.

Fabien

On Fri, May 28, 2021 at 9:51 PM Kathleen Moriarty <
[email-masked]> wrote:

> Hi Adrian,
>
> Thanks for your interest!
>
> This is a helpful link that describes how the attackers were able to
> bypass MFA by stealing the signing key for SAML assertions:
>
> https://www.darkreading.com/attacks-breaches/solarwinds-campaign-focuses-attention-on-golden-saml-attack-vector/d/d-id/1339794
>
> https://owasp.org/www-chapter-singapore/assets/presos/Deconstructing_the_Solarwinds_Supply_Chain_Attack_and_Deterring_it_Honing_in_on_the_Golden_SAML_Attack_Technique.pdf
>
> I did read one that was a bit better, but can't find the link at the
> moment.
>
> And one on shared OAuth credentials/token issuance:
>
> https://www.csoonline.com/article/3607348/how-to-defend-against-oauth-enabled-cloud-based-attacks.html
>
> It would be good to think about attack vectors and if not prevention,
> minimally detection.
>
> Best regards,
> Kathleen
>
> On Fri, May 28, 2021 at 3:41 PM Adrian Gropper <[email-masked]>
> wrote:
>
>> Hi Kathleen,
>>
>> I am not aware of the attacks on SAML and OAuth and would appreciate a
>> link or two.
>>
>> I hope we can provide guidance on how GNAP can facilitate Zero Trust
>> Architecture and believe that includes guidance on how to audit various
>> things as systems use GNAP protocols to separate concerns among independent
>> actors.
>>
>> Count me in for a brainstorming sessio,
>>
>> - Adrian
>>
>>
>> On Fri, May 28, 2021 at 3:29 PM Kathleen Moriarty <
>> [email-masked]> wrote:
>>
>>> Hello!
>>>
>>> In light of recent attacks against SAML and OAuth, I'd like to see what
>>> defense mechanisms and detection could be built into the spec.  One example
>>> would be from the recent SAML attack.  If there was a detection of
>>> instances of authorization without authentication, the SAML attack used in
>>> SolarWinds might have been detected sooner.
>>>
>>> If you think along the lines of fraud detection, where you detect
>>> unusual events, there may be some specific to GNAP that could enable early
>>> detection of abuse, misuse, or exploits.
>>>
>>> Are there some planned?  Would people like to brainstorm on this?
>>> Thanks!
>>>
>>>
>>> --
>>>
>>> Best regards,
>>> Kathleen
>>> --
>>> TXAuth mailing list
>>> [email-masked]
>>> https://www.ietf.org/mailman/listinfo/txauth
>>>
>>
>
> --
>
> Best regards,
> Kathleen
> --
> TXAuth mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/txauth
>

---

From: Justin Richer <[email-masked]>
Date: Tue, 1 Jun 2021 09:51:48 -0400

Hi Kathleen, thanks so much for raising this topic! It’s important that GNAP learn from what’s come before.

Some aspects of that are already built into the design, based on what we’ve learned form years of OIDC and SAML deployments. One of the things that made the SAML attacks work was that the fake assertions could be easily injected into SP’s (the relying party equivalent) with a browser request by the attackers. GNAP already doesn’t allow injection of results (such as assertions) over the front channel, so an attacker would need to run an in-the-middle attack against the AS and return the faulty assertion as well. Properly configured OIDC (with state and nonce) has some similar protections, but even then it’s more easily misconfigured.

I agree that the detection of unusual events needs to be part of the protocol. Maybe we should have more language about the direct information return — things like assertions and subject information — and explicitly tell clients that they shouldn’t accept that information from unexpected calls of any type? We might also want to lock down the callback function from extensions so that people don’t re-invent the implicit flow and all its problems.

I don’t know if there’s anything that can be done around protecting against key theft. The key is the identity of the component proven through the protocol. Do you have suggestions on how this can be called out more? The security considerations section is just a placeholder still, and it seems that would be a good place for it, to me.

 — Justin

> On May 28, 2021, at 3:28 PM, Kathleen Moriarty <[email-masked]> wrote:
> 
> Hello!
> 
> In light of recent attacks against SAML and OAuth, I'd like to see what defense mechanisms and detection could be built into the spec.  One example would be from the recent SAML attack.  If there was a detection of instances of authorization without authentication, the SAML attack used in SolarWinds might have been detected sooner.
> 
> If you think along the lines of fraud detection, where you detect unusual events, there may be some specific to GNAP that could enable early detection of abuse, misuse, or exploits.
>

---

From: Fabien Imbault <[email-masked]>
Date: Tue, 1 Jun 2021 16:02:46 +0200

The most advanced discussion I've seen on private key protection is from
the cryptocurrency world, since it's so sensitive (and there have been many
such attacks). In practice, you find hardware (ex: ledger, etc.) and
software (ex: threshold cryptography, sandboxes such as WASI or lavamoat,
etc.) solutions.

Fabien

On Tue, Jun 1, 2021 at 3:52 PM Justin Richer <[email-masked]> wrote:

> Some aspects of that are already built into the design, based on what
> we’ve learned form years of OIDC and SAML deployments. One of the things
> that made the SAML attacks work was that the fake assertions could be
> easily injected into SP’s (the relying party equivalent) with a browser
> request by the attackers. GNAP already doesn’t allow injection of results
> (such as assertions) over the front channel, so an attacker would need to
> run an in-the-middle attack against the AS and return the faulty assertion
> as well. Properly configured OIDC (with state and nonce) has some similar
> protections, but even then it’s more easily misconfigured.
>
> I agree that the detection of unusual events needs to be part of the
> protocol. Maybe we should have more language about the direct information
> return — things like assertions and subject information — and explicitly
> tell clients that they shouldn’t accept that information from unexpected
> calls of any type? We might also want to lock down the callback function
> from extensions so that people don’t re-invent the implicit flow and all
> its problems.
>
> I don’t know if there’s anything that can be done around protecting
> against key theft. The key is the identity of the component proven through
> the protocol. Do you have suggestions on how this can be called out more?
> The security considerations section is just a placeholder still, and it
> seems that would be a good place for it, to me.
>
>  — Justin
>

---

From: Denis <[email-masked]>
Date: Tue, 1 Jun 2021 16:07:46 +0200

Hi Kathleen,

Thank you for your mail. I do appreciate the following sentence that you 
wrote:

Unfortunately, at this stage, the current documents still do not 
describe the trust relationships between the various components of the 
system.
The issue about trust relationships#214 is still open: 
https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/214

The document does not describe the error codes that should be returned 
by the various component either.
The issue about" The access token verifications to be performed by the 
RS should be described #30" available at:
https://github.com/ietf-wg-gnap/gnap-resource-servers/issues/30 has been 
recently opened.

The issue about  Requesting resources with insufficient access #203 has 
been closed without the definition of the error codes:
https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/203

Since access tokens are, for the time being, considered to be opaque to 
the clients/end-users and subject to private agreements between ASs and RSs
this makes hard or impossible to perform a security analysis under these 
conditions.

Nevertheless, I have indicated to the WG, when two users accept to 
collide against a RS, the possibility to transmit an access token from 
an authorized user
to an unauthorized user. This may happen even under the "assumption that 
private keys can be secured, by whatever means". In such a case, prevention
is impossible, but detection is possible (as you said "if not 
prevention, minimally detection").

I have presented the case at he last IETF meeting on March, the 9 th , 
2021. The title of the presentation was:
GNAP model & trust relationships Privacy considerations & Security 
considerations
These slides are available at: 
https://datatracker.ietf.org/meeting/110/materials/slides-110-gnap-gnap-model-and-trust-relationships-00 
<https://datatracker.ietf.org/meeting/110/materials/slides-110-gnap-gnap-model-and-trust-relationships-00>

Slide 10 is about : Unlinkability between RS user accounts versus Client 
collaboration attacks. It indicates:

       if an access token only contains one or more capabilities, client 
collaboration attacks will succeed.
       In order to defeat client collaboration attacks, the access token 
must also contain a type (1), (2) or (3) end-user identifier.

Note that is an answer somewhat related to the question just raised by 
Justin: "I don’t know if there’s anything that can be done around 
protecting against key theft".

Last comment: Security is certainly important, but the user's privacy is 
equally important. At the current time,Unlinkability #241
https://github.com/ietf-wg-gnap/gnap-core-protocol/issues/241 attempts 
to address a part of the problem.

However, unfortunately, the current trend is to think about the user's 
privacy once the design will be finished instead of thinking about 
privacy before
the starting the design or even during the design. At the current time, 
all the properties that would allow an AS to act as *Big Brother* have 
been defined
(and none to stop it).

Best regards,

Denis

> Hi Kathleen, thanks so much for raising this topic! It’s important 
> that GNAP learn from what’s come before. Some aspects of that are 
> already built into the design, based on what we’ve learned form years 
> of OIDC and SAML deployments. One of the things that made the SAML 
> attacks work was that the fake assertions could be easily injected 
> into SP’s (the relying party equivalent) with a browser request by the 
> attackers. GNAP already doesn’t allow injection of results (such as 
> assertions) over the front channel, so an attacker would need to run 
> an in-the-middle attack against the AS and return the faulty assertion 
> as well. Properly configured OIDC (with state and nonce) has some 
> similar protections, but even then it’s more easily misconfigured. I 
> agree that the detection of unusual events needs to be part of the 
> protocol. Maybe we should have more language about the direct 
> information return — things like assertions and subject information — 
> and explicitly tell clients that they shouldn’t accept that 
> information from unexpected calls of any type? We might also want to 
> lock down the callback function from extensions so that people don’t 
> re-invent the implicit flow and all its problems. I don’t know if 
> there’s anything that can be done around protecting against key theft. 
> The key is the identity of the component proven through the protocol. 
> Do you have suggestions on how this can be called out more? The 
> security considerations section is just a placeholder still, and it 
> seems that would be a good place for it, to me. — Justin
>> On May 28, 2021, at 3:28 PM, Kathleen Moriarty 
>> <[email-masked]> wrote: Hello! In light of recent 
>> attacks against SAML and OAuth, I'd like to see what defense 
>> mechanisms and detection could be built into the spec. One example 
>> instances of authorization without authentication, the SAML attack 
>> used in SolarWinds might have been detected sooner. If you think 
>> along the lines of fraud detection, where you detect unusual events, 
>> there may be some specific to GNAP that could enable early detection 
>> of abuse, misuse, or exploits. Are there some planned? Would people 
>> like to brainstorm on this? Thanks! -- Best regards, Kathleen -- 
>> TXAuth mailing list [email-masked]