SAML Spoofing

[Jeffrey T Eaton]

I’ve seen the same sort of error messages, with jesterscourt.cc.   I assumed it was some sort of attack that was failing.

jesterscourt.cc appears to be the blog of a “hacktivist”.   http://en.wikipedia.org/wiki/The_Jester

-jeaton

On Jul 17, 2014, at 1:43 PM, Schwoerer, Brad <schwoerb at uww.edu> wrote:

> I was wondering if anyone else was seeing jesterscourt.cc trying to spoof their IdP.
> 
> 
> 
> Date: Tuesday, July 15, 2014 at 1:28 AM
> To: icit-shibTech <icit-shibTech at uww.edu<mailto:icit-shibTech at uww.edu>>
> Subject: [SHIB IdP] SAML message intended destination endpoint 'https://idp.uww.edu/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://jesterscourt.cc/idp/profile/SAML2/Redirect/SSO'
> 
> ________________________________
> 
> Log session start time Tue Jul 15 01:28:04 CDT 2014
> 
> Date    Thread  Level   Logger  MDC     Message
> 2014-07-15 01:28:03,971 TP-Processor129 INFO    Shibboleth-Access       JSESSIONID=EA66319349527F97E25DBAFB438D6510, clientIP=66.172.11.245     20140715T062803Z|66.172.11.245|jesterscourt.cc:443|/profile/SAML2/Redirect/SSO|
> 2014-07-15 01:28:03,975 TP-Processor129 INFO    org.opensaml.ws.message.decoder.BaseMessageDecoder      JSESSIONID=EA66319349527F97E25DBAFB438D6510, clientIP=66.172.11.245     https://shib.courseleaf.com/shibboleth
> 2014-07-15 01:28:03,975 TP-Processor129 ERROR   org.opensaml.common.binding.decoding.BaseSAMLMessageDecoder     JSESSIONID=EA66319349527F97E25DBAFB438D6510, clientIP=66.172.11.245     SAML message intended destination endpoint 'https://idp.uww.edu/idp/profile/SAML2/Redirect/SSO' did not match the recipient endpoint 'https://jesterscourt.cc/idp/profile/SAML2/Redirect/SSO'
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net