The "Confused Deputy Problem" is a classic pitfall when designing permission systems, and it is still relevant in today's SaaS vendor world. Learn about the problem and its solution with practical examples.

1. 1 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
The Confused Deputy Problem
Shay Ben-Haroche
2020-07-22

2. 2 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
• WIIFM
• What is “The Confused Deputy Problem” ?
• Example(s) and solution(s)
• Why should we care?
Agenda

3. 3 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
• Learn a classic security pitfall
• Still relevant in the SaaS vendors era
• Learn how to protect against it
• Potential application for Luminate’s connector
WIIFM - What’s in it for me?

4. 4 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
“A ‘confused deputy’ is a legitimate, more privileged
computer program that is tricked by another program
into misusing its authority on the system.
It is a specific type of privilege escalation” (wikipedia)
What is “the Confused Deputy Problem”

5. 5 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
Basic Example
• Two resources:
– Alice can execute compiler, but not write to file (BILL)
– Compiler can read-write to file (BILL)
• Compiler is a deputy acting on behalf of Alice
• Compiler is confused, because it escalates Alice’s
privileges and allows her to write to BILL

6. 6 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
• Bundle together the designation of an object and the
permission to access that object
• In our example - Alice passing the compiler both the
filename it wants to write, and a permission token
• This is exactly what a capability is (as opposed to ACL)
Basic Example - Simple Solution

7. 7 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|

8. 8 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
• Luminate wants to save AWS costs using CloudSave
• CloudSave asks Luminate to provide an IAM role ARN, e.g:
arn:aws:iam::123456789:role/CloudSaveRole
(The IAM role can only be assumed by CloudSave)
• CloudSave has another customer: EvilCorp
• When EvilCorp finds/guesses Luminate’s AWS account ID
• EvilCorp provides the same IAM role ARN to CloudSave
• CloudSave is now a Confused Deputy
IAM Role Example

9. 9 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
IAM Role Example

10. 10 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|

11. 11 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
• Unique GUID per customer
• Provided by the vendor (CloudSave)
• Cannot be easily guessed
• Enforced in the “Condition” section of the IAM role
The Solution - External ID

12. 12 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
IAM Role Example - with External ID

13. 13 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|

14. 14 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|
• Classic pitfall, still relevant today
• Potential application for Luminate’s connector
• Read more:
– ACL-based security
– Capability-based security
– AWS’ blog (with the IAM example)
– ACL vs. C-List
Summary

15. 15 Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.|Broadcom Proprietary and Confidential. Copyright © 2018 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
Thanks!
Questions?
Shay Ben-Haroche
2020-07-22