Get the latest tech news
Echoes of SolarWinds in New 'Silver SAML' Attack Technique
A successor to the "Golden SAML" tactic used in the SolarWinds campaign, this new technique taps SAML response forgery to gain illegitimate access to apps and services.
The technique involved stealing the victim organization's Active Directory Federation Services (ADFS) token-signing certificate and using it to forge SAML response tokens. It also works in Microsoft Entra ID (formerly Azure AD) and any other identity provider environment that permits the import of externally generated SAML signing certifications, Semperis said. The research highlights why organizations that use externally generated certificates should take care to manage them securely and ensure they are protected as a Tier 0 — or critical — resource, he says.
Or read this on r/technology