Michael McIntosh, Paula Austel. Web services: XML signature element wrapping attacks and countermeasures. Proceedings of the 2005 workshop on secure web services, pp. 20-27. ACM Workshop on Secure Web Services, colocated with the ACM conference on Computer and Communication Security 2005. (pdf)
Hyen V Chung, Michael McIntosh, Paula K Austel, Masayoshi Teraguchi. Web services security: Sign and encrypt any element in a SOAP message. IBM Developerworks. (html)