On Breaking SAML Be Whoever You Want to Be Form

Instructions and help about On Breaking SAML Be Whoever You Want To Be

introduction ari this is joint work with fiori zomorovsky jerk schwenk marcus campman and michael jensen from house gods institute for i.t security at war universitat bowhum my name is andreas meyer and the title of this talk is on breaking saml be whoever you want to be our research was was recently published on this year's usenix security symposium at washington at bellevue washington usa so at first i'd like to give you a short overview of the talk i will present some novel attacks on the saml protocol which allowed us to authenticate as whoever we wanted to be we did the first in-depth analysis of 14 prominent sample frameworks and providers and about 80 percent of them could be broken by novel xml signature wrapping attacks possibly millions of users were affected by our findings and thousands of saml based websites so first motivation who has ever heard of saml before oh ok good so semi is the abbreviation of security assertion markup language and is an xml based protocol for exc