The Rise of Consent and Other Application-based Phishing Attacks
OAuth consent-based and other application phishing attacks: anatomy, variants, detection, and prevention.
Research articles and posts
Protecting Credentials in SAP HANA: The Client Secure User Store
How the HANA client Secure User Store protects credentials, what can go wrong, and best practices.
Exploring the SAP HANA SQL Command Network Protocol – Federated Authentication
HANA series part 3: federated authentication — SAML, logon tickets, JWTs, Kerberos, and session cookies.
Exploring the SAP HANA SQL Command Network Protocol – Password-based Authentication and TLS
HANA series part 2: password-based authentication mechanisms and protecting protocol traffic with TLS.
Exploring the SAP HANA SQL Command Network Protocol – Protocol Basics and Authentication
HANA series part 1: protocol basics, traffic dissection, packet crafting, tenant discovery, and authentication 101.
Why Browser Fingerprinting is Creating Challenges for Identity Security
Why browser fingerprinting — and the browser vendors' war against it — challenges identity security.
Revisiting the Old and Looking at New Potential SAP Vulnerabilities
Old notes and new findings on SAP archive files, path traversals, and in-archive signature pitfalls.
Hijacking 2FA – A look at Mobile Malware Through an Identity Lens
How mobile malware steals 2FA codes and bypasses MFA — an identity-lens view with a Cerberus case study.