Ever Heard of "Golden SAML" - This is a technique for Compromising (SAML based) SSO

The pre-reqs  for this are heavy however,the returns could be great for the hackers


It could allow an attacker to fake enterprise user identities and forge authentication to gain access to valuable cloud resources in a federation environment

“Golden SAML poses serious risk because it allows attackers to fake an identity and forge authentication to any cloud app (Azure, AWS, vSphere, etc.) that supports SAML authentication. Using this post-exploit technique, attackers can become any user they want to be – with the highest level of privileges – and gain approved, federated access to a targeted app,” researchers wrote.

The prerequisites of such attacks, however, are considerable. Among other things, hackers will need the private key that signs the SAML objects, an Active Directory Federation Services user account, token-signing private key, an identity provider (IdP) public certificate and an IdP name.

For More
https://threatpost.com/saml-post-intrusion-attack-mirrors-golden-ticket/128993/

Authentication - PIN, Touch ID, Face ID - Pros and Cons.

Here is an excellent article that provides some clarification

https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/

SMS Authentication - Is it Good enough.

We have two piece of information.

• SMS message is used for 2-factor authentication.
• SMS messages can be intercepted.

So, how secure is it and does it meed our needs?


The author evaluates it based on fundamentals like

1. Requirement
2. Simplicity
3. Convenience (Ease of Use)
4. Risk versus Rewards
5. End result (Better or Worse than before)

The link below has more information:-

http://www.csoonline.com/article/2136755/security-leadership/why-you-need-to-rethink-the-benefits-of-sms-authentication-to-improve-security.html

Biometrics - New virgin territory "Ear Wax" (after "Under Arm")

Who would of thought of it.

Now, does this mean , if this is successful , the employees will be instructed to keep their ear dirty. This will work for the company but not for those would like to keep your company.

And same thing goes for "Under Arm Odor". Does this mean , I should stop taking bath?

According to the article:- 

Scientists from the Monell Center analysed the chemicals that give earwax its distinctive, pungent smell – and found that compounds in the wax could be used to identify the wax creator’s racial origins, with ear wax differing markedly between East Asians and Caucasians.

“Our previous research has shown that underarm odors can convey a great deal of information about an individual, including personal identity, gender, sexual orientation, and health status,” said study senior author George Preti, PhD, an organic chemist at Monell. “We think it possible that earwax may contain similar information.”

The links below has more information:-

http://www.welivesecurity.com/2014/03/26/sniffing-earwax-could-offer-icky-new-frontier-in-biometrics