Re:OneLogin: Breach Exposed Ability to Decrypt Data
by cube00 on Friday June 02, 2017 @04:59AM
(#14468511)
For SAML at least if the identity provider is compromised, meaning I can now issue tokens using it's certificate, each service will need to be provided with a new certificate. That requires 'reach out' to each service,
[ Parent
| on HN ]
Re:OneLogin: Breach Exposed Ability to Decrypt Data
by shimms on Friday June 02, 2017 @05:38AM
(#14468664)
Yup - we had to reconfigure each service that uses SAML today.
Also don't forget having to audit each service's API keys/tokens/local users etc to make sure someone hasn't gotten access via a compromised certificate and then created a sneaky API key for them to use in the future.
Basically we had to assume every app had been compromised and rotate every internal key/certificate the was in each one, as well as reconfigure them with a new SAML certificate.