Detecting Abuse of Authentication Mechanisms – Abridged

Contact Your Elected Officials

Summary

Malicious cyber actors are abusing trust in federated authentication environments to access protected data. An “on premises” federated identity provider or single sign-on (SSO) system lets an organization use the authentication systems they already own (e.g. tokens, authentication apps, one-time passwords, etc.) to grant access to resources, including resources in “off premises” cloud services. These systems often use cryptographically signed automated messages called “assertions” shared via Security Assertion Markup Language (SAML) to show that users have been authenticated. When an actor can subvert authentication mechanisms, they can gain illicit access to a wide range of an organizations assets.

In some cases, actors have stolen keys from the SSO system that allow them to sign assertions and impersonate any legitimate user who could be authenticated by the system. On 7 December, NSA reported on an example where a zeroday vulnerability was being used to compromise VMware Access®1 and VMware Identity Manager®2 servers, allowing actors to forge authentication assertions and thus gain access to the victim’s protected data. In other cases, actors have gained enough privileges to create their own keys and identities such as “service principals” (cloud applications that act on behalf of a user) or even their own fake SSO system. According to public reporting, in some cases, the SolarWinds Orion®3 code compromise provided actors initial access to an on-premises network which led to access within the cloud.

Note that these techniques alone do not constitute vulnerabilities in the design principles of federated identity management, the SAML protocol, or on-premises and cloud identity services. The security of identity federation in any cloud environment directly depends on trust in the on-premises components that perform authentication, assign privileges, and sign SAML tokens. If any of these components is compromised, then the trust in the federated identity system can be
abused for unauthorized access.

To defend against these techniques, organizations should pay careful attention to locking down SSO configuration and service principal usage, as well as hardening the systems that run on-premises identity and federation services. Monitoring the use of SSO tokens and the use of service principals in the cloud can help detect the compromise of identity services. While these techniques apply to all cloud environments that support on-premises federated authentication, the following specific mitigations are focused on Microsoft Azure®4 federation. Many of the techniques can be generalized to other environments as well.

Disclaimer of Endorsement

The information and opinions contained in this document are provided “as is” and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.

Purpose

This document was developed in furtherance of NSA’s cybersecurity missions, including its responsibilities to identify and disseminate threats to National Security Systems, Department of Defense, and Defense Industrial Base information systems, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.

Contact

Client Requirements / General Cybersecurity Inquiries: Cybersecurity Requirements Center, 410-854-4200, Cybersecurity_Requests@nsa.gov

Media inquiries / Press Desk: Media Relations, 443-634-0721, MediaRelations@nsa.gov

Detecting Abuse of Authentication Mechanisms – Abridged

AUTHENTICATION_MECHANISMS_CSA_EXEC_U_OO_198854_20

Detecting Abuse of Authentication Mechanisms

AUTHENTICATION_MECHANISMS_CSA_U_OO_198854_20

The Thinking Conservative
The Thinking Conservativehttps://www.thethinkingconservative.com/
The goal of THE THINKING CONSERVATIVE is to help us educate ourselves on conservative topics of importance to our freedom and our pursuit of happiness. We do this by sharing conservative opinions on all kinds of subjects, from all types of people, and all kinds of media, in a way that will challenge our perceptions and help us to make educated choices.

Trump’s Middle East Triumph is Worth Celebrating Even As Peace Remains Elusive 

President Trump’s bold foreign policy defies globalist appeasement, showcasing unwavering American strength and decisive leadership on the world stage.

Are conservatives fighting a fiction of woke?

Wokery, it hurts to say it, is too disorganized to have an organized cosmology or doctrine of metaphysical belief.

Illinois Democrat Offenders Reveal Party

The crime of J.B Pritzker and Brandon Johnson in this episode of American history is called subversion at the least , but could be as serious as treason.

Inside the Public School Librarian Jihad to Keep Transgender Propaganda on Shelves

Public school librarians are doing all they can to keep child tranny propaganda flowing directly into the malleable minds of their charges.

Five Reasons Why The Latest Czech Elections Were So Important

Populist-nationalist politician Andrej Babis is poised to return to the premiership after his party's victory. Here are 5 reasons why this is so important.

New York AG Letitia James Indicted on Federal Charges

New York Attorney General Letitia James was indicted by a grand jury on federal charges, according to an indictment on unsealed on Thursday.

6 Ways Vaccine Policy Has Changed Under RFK Jr.

Health Sec RFK, Jr. and officials at the HHS changed recommendations and policies for multiple vaccines, including shots against COVID-19 and measles.

Journalists Recount Antifa Violence in Roundtable With Trump

President Trump met at the White House with journalists attacked by the newly designated terrorist group Antifa, joined by Cabinet officials for a roundtable.

IRS to Furlough 34,000 Employees as Government Shutdown Halts Treasury Operations

The IRS said in an emergency message to staff that it will furlough more than 34,000 employees starting on Oct. 8 due to the government shutdown.

Trump Says He May Invoke Insurrection Act in Portland If Necessary

President Donald Trump on Oct. 6 said he may consider invoking the Insurrection Act in Portland, Oregon, if necessary.

Trump: All Medium, Heavy Duty Trucks Entering US Will See 25 Percent Tariff on Nov. 1

President Trump announced on Monday that all medium and heavy-duty trucks entering the United States will see a 25 percent tariff starting on Nov. 1.

Treasury Names Social Security Commissioner as CEO of IRS

Treasury Sec. Scott Bessent announced that Frank Bisignano, the head of the Social Security Administration (SSA), will also serve as CEO of the IRS.

Agencies Terminated, Descoped 94 Wasteful Contracts With $8.5 Billion Ceiling Value, Says DOGE

Various federal government agencies have terminated and descoped 94 wasteful contracts over the past five days, DOGE said in an Oct. 4 post on X.
spot_img

Related Articles

Popular Categories

MAGA Business Central