SAML

We're pulling from Microsoft's threat intelligence reports on the midnight blizzard compromise, plus highly technical intra-architectural documentation, CISA advisories covering the dark side ransomware incident, and the Ivanti Connect secure vulnerabilities.

Also, a pretty sobering 8K filing from T-Mobile and extensive threat research on golden SAML attacks.

And, you know, the connective tissue between all of those sources is the realization that the perimeter is no longer the primary battleground.

It's just not.

It is practically the only reliable artifact an incident response team has to detect when a threat actor is scraping mailboxes via APIs using application impersonation.

If your enterprise does not have that specific purview telemetry enabled and actively feeding into your SIM, you simply do not have the architectural visibility required to see machine identity data exfiltration.

As you explain this, I can't help but compare it to another massive identity compromise vector we've seen, Golden SAML.

Oh, yes.

It's the same that you don't trust a network.

Every packet carries... um you know authenticate well the packet it's more like in the protocol level the um authentication is sometimes injected by the like in in um in go teleport you can have an oidc provider so that it can you know with saml uh push through your identity so you log in once um and then your identity is propagated towards any service behind but you have to set up like a saml integration or a yeah yeah

yeah there's some Sort of, what do you call that?

XML is the most annoying one because it's XML, but there's the other one, I think it's Jot, right? It's OIDC, so it's OIDC, yeah.

And then you get managed CI with it, webhooks, all the good stuff, everything, all the features, basically.

And then moving on from individuals, I have organizations and they can be businesses, so like small or medium-sized businesses, and they would just have team plans where they don't get the SCIM, like automatic provisioning of accounts that you need for enterprise, SAML, like these kind of enterprise-y features.

They would fall out of the team plan, but team plan gives you an organization with private repos, enough minutes, CI minutes that you're fine.

And yeah, basically all you need as a business, right? And then enterprise is enterprise features, mostly authentication features, audit logs, and self-hosting as well.

A network engineer who knows BGP thoroughly has the model write the Python that parses 40 router configs.

An identity architect who can recite the auth specifications has it decode in an unfamiliar SAML assertion, then asks why it was built that way.

They hold the why and hand over only the how.

The historical parallel is well chosen.

The techniques themselves were not exotic.

CrowdStrike says that in one intrusion, an unsigned SAML assertion combined with an XML external entity flaw was used to query cloud instance metadata.

In another, an unauthenticated orchestration service gave root access in a production container environment.

Unsigned assertions and unauthenticated services.

CrowdStrike's advice is practical.

Rotate signing keys and service credentials after any suspected exposure, including keys in historical backups and directory exports.

Enforce SAML signature validation and require IMDS version 2 on cloud instances.

None of which is new.