Passport Project Introduction -- Single Sign-on Concept Demo of Passport Behind the Scenes -- Packet Capture Vulnerabilities & Futures Team –Jay Benson, AACC –Lew Pulsipher, CCCC –Roseann Thomas, FTCC –Tenette Prevatte, FTCC

Single Sign-on Concept Numerous Accounts –Internet Stores –Financial Orgs –Etc. One Passport Account –Trusted Intermediary –Holds User ID and Wallet Passport Account Authenticates User to All Accounts –Automatic re-direction –Encrypted links and cookies

Single Sign-on Big Picture Through pre-arrangement, User has signed an agreement with Passport.com. 1.User accesses some site, clicks on Passport icon, and is re-directed to Passport.com. 2.User authenticates to Passport.com, and is given an encrypted cookie Notice that Passport.com does not communicate directly with the target site 3.User is re-directed back to original site, and cookie is used to validate user to the site 4.User continues dialog with site 1 2 3,4 Some Site Passport.com

Typical Attacks Centralized database –Fake Merchant Site –DNS Redirections –Hack Centralized Database Dependence on fundamentally insecure mechanisms –Dependence upon JavaScript –Cookies are Persistent

The Dilemma of Vulnerability Reporting Two ways for “white hats” to report vulnerabilities –Secretly notify a few individuals and the vendor –Announce the problem on bug/security forums Each method has advantages and drawbacks Reporting of Passport vulnerabilities especially illustrates these drawbacks

“Secret” Disclosure Method Secret method –For months, before the vulnerability is fixed, people are at risk –If the vulnerability is never fixed, who knows about it? –If the vulnerability is fixed with a “quiet” patch, how many users will ignore the patch –What if “some kid” discovers the problem, rather than a well-known security person?

Announce to the World Announce to the world method –Too often, the vulnerability is never fixed, or “some kid” gets frustrated –The vulnerability is then announced to the world Drawback: now there’s a mad scramble to patch the problem before Black Hats take advantage of it Advantage: problem gets fixed, and gets fixed FAST Because the unknown person gets such publicity, there’s every incentive to use the “announce” method

Some Examples Some Passport Vulnerability reports –IEEE Computer Networks Journal, July 2000 “Risks of the Passport Single Signon Protocol” –2600 Quarterly, Fall 2001 “Passport Hacking” –Shiflett.org, Aug 2002 “Passport Hacking Revisited” –Gartner Research, May 2003 (Pakistani researcher) “Security Flaw Shows…” –“Secret” method referred to in Jan 2005 in CSO Magazine “Beyond Passport Vulnerabilities” –And many others

Variety of approaches IEEE highly respected, “secret” report first 2600 is “The Hacker Quarterly” (see 2600.com); probably not “secret” Shiflett.org—follow-up to 2600 showing how to hack Microsoft’s fix! Gartner respected research group, but the original discoverer evidently used the non-secret method of reporting. In “CSO” only the existence, not details, of a vulnerability is reported, which was fixed very quickly