Abstract:Single Sign-On (SSO) systems simplify login procedures by using an an Identity Provider (IdP) to issue authentication tokens which can be consumed by Service Providers (SPs). Traditionally, IdPs are modeled as trusted third parties. This is reasonable for SSO systems like Kerberos, MS Passport and SAML, where each SP explicitely specifies which IdP he trusts. However, in open systems like OpenID and OpenID Connect, each user may set up his own IdP, and a discovery phase is added to the protocol flow. Thus it is easy for an attacker to set up its own IdP. In this paper we use a novel approach for analyzing SSO authentication schemes by introducing a malicious IdP. With this approach we evaluate one of the most popular and widely deployed SSO protocols - OpenID. We found four novel attack classes on OpenID, which were not covered by previous research, and show their applicability to real-life implementations. As a result, we were able to compromise 11 out of 16 existing OpenID implementations like Sourceforge, Drupal and ownCloud. We automated discovery of these attacks in a open source tool OpenID Attacker, which additionally allows fine-granular testing of all parameters in OpenID implementations. Our research helps to better understand the message flow in the OpenID protocol, trust assumptions in the different components of the system, and implementation issues in OpenID components. It is applicable to other SSO systems like OpenID Connect and SAML. All OpenID implementations have been informed about their vulnerabilities and we supported them in fixing the issues.

Outflanking and securely using the PIN/TAN-System

A secure and efficient user authentication protocol for two-tiered wireless sensor networks

A Penetration Testing Method for E-Commerce Authentication System Security

Securing Password Authentication for Web-based Applications

Off-Path Attacking the Web

The Cracking and Countermeasures for PIN BLOCK

Logging safely in public spaces using color PINs

How to Design a Blue Team Scenario for Beginners on the Example of Brute-Force Attacks on Authentications

INNOVATIVE METHODS TO ENHANCE TRANSACTION SECURITY OF BANKING APPLICATIONS

A User Anonymous Mutual Authentication Protocol.

Design, Implementation, and Automation of a Risk Management Approach for Man-at-the-End Software Protection

On the Usability of Two-Factor Authentication.

Defending Against Identity Threats Using Risk-Based Authentication

When Human cognitive modeling meets PINs: User-independent inter-keystroke timing attacks

Two-factor authentication in industrial Internet-of-Things: Attacks, evaluation and new construction

Attack Analysis and Improvement of Password Authentication Protocol

Attacks and Countermeasures on Smartcard Operating Terminals

Defense against impersonating attackers: An efficient RFID mutual authentication protocol based on standard

Security Analysis and Improvement of the TPM's Two Main Authorization Protocols

Do not trust me: Using malicious IdPs for analyzing and attacking Single Sign-On

Anti-Authority Hijack Secure Electronic Transaction