𝗧𝗵𝗲 𝗚𝗼𝗹𝗱𝗲𝗻 𝗦𝗔𝗠𝗟 𝗔𝘁𝘁𝗮𝗰𝗸: 𝗔 𝗦𝘁𝗲𝗽-𝗯𝘆-𝗦𝘁𝗲𝗽 𝗚𝘂𝗶𝗱𝗲.

Golden SAML was one of the major techniques used by the threat actor as part of the SolarWinds attack by compromising the SAML signing certificate using their Active Directory privileges.

Collected.

Courses | Ace the System Design and Coding Interview

Golden SAML was one of the major techniques used by the threat actor as part of the SolarWinds attack by compromising the SAML signing certificate using their Active Directory privileges.

An attacker must first gain administrative access to the ADFS server and extract the necessary certificate and private key to successfully leverage Golden SAML.

Once these privileges are obtained, the attack will proceed according to the following steps:

𝗜𝗻𝗶𝘁𝗶𝗮𝗹 𝗔𝗰𝗰𝗲𝘀𝘀 𝗮𝗻𝗱 𝗞𝗲𝘆 𝗘𝘅𝘁𝗿𝗮𝗰𝘁𝗶𝗼𝗻: The attacker first accesses the ADFS (Active Directory Federation Services) server and extracts the private key and certificate.

𝗧𝗮𝗿𝗴𝗲𝘁𝗶𝗻𝗴 𝗦𝗲𝗿𝘃𝗶𝗰𝗲𝘀 (𝗲.𝗴., 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗢𝗳𝗳𝗶𝗰𝗲): The user (in this case, the attacker) attempts to access a federated service, such as Microsoft Office.

𝗥𝗲𝗱𝗶𝗿𝗲𝗰𝘁𝗶𝗼𝗻 𝗳𝗼𝗿 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻: The Service Provider (SP) redirects the attacker to ADFS for authentication.

𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗕𝘆𝗽𝗮𝘀𝘀 𝗮𝗻𝗱 𝗙𝗼𝗿𝗴𝗲𝗱 𝗦𝗔𝗠𝗟 𝗥𝗲𝘀𝗽𝗼𝗻𝘀𝗲: Here’s where the ‘golden’ aspect comes into play. The attacker bypasses ADFS #authentication by signing a forged #SAML response using the stolen certificate and key.

𝗚𝗮𝗶𝗻𝗶𝗻𝗴 𝗔𝗰𝗰𝗲𝘀𝘀: This forged SAML response is then presented to the desired service, granting the attacker access.

Reco AI-driven platform effectively combats Golden SAML attacks by enhancing visibility and control in SaaS environments, utilizing key features like Identity & Access Governance and SaaS Detection & Response to prevent unauthorized access and certificate exploitation.