Microsoft has been aware of the AAD/O365 vulnerability for almost 2 years.

A friend found this link, clearly showing Microsoft has been aware of the risk of users giving consent to illicit applications since at least January 2018.
https://blogs.technet.microsoft.com/office365security/defending-against-illicit-consent-grants/

They have not done much to prevent this, but has worked to create more post-mortem tools.

One of the links in the article points to an article by a former cyber criminal, which has a youtub video showing PoC of a real-time crypto-locker working on the users mailbox. Scary stuff.

https://youtu.be/VX59Gf-Twwo

What has changed

What makes this even worse today is, that the Microsoft Sample code Wizard makes it very easy to create the phishing website. The wizard generates passwords, and creates source code with your own AppID and password inserted. So now we are down where this is possible with a minimum of coding skills.

We also have the fact, that 2 years ago, knowledge of free Let's Encrypt certificate was not so widespread, and a HTTPS certificate is a requirement from Microsoft.

I am not working as a developer, but do have some coding/scripting experience, and I got the sample to run in about the 5 minutes Microsoft says it takes.

The hacker/developer that requests consent gets a long list of checkboxes, and he can see which permissions not to ask for, that is all those that require admin consent.

As somebody who manages security in O365 instances, I would like to have a mask I could apply to my users. Allow them to do OAuth2 / OpenID authentication everywhere and deliver e-mail address and name to the remote website without consent. Maybe allow people to give 3rd party access to their calendar.

As it is now, I have to grant consent on a per app basis, as I have revoked all user consent options completely.

But my idea with admin controlling what permissions the users can delegate will make the job more difficult for developers, as they never know if the user will need to get admin consent or not. But it would allow me to open up a bit more than I do now,  after my discovery.
https://securityintheenterprise.blogspot.com/2019/11/microsoft-azuread-and-office365-not.html

Local Microsoft office is not happy about my release of my blog article, they feel bypassed, and I should have gone through them. But all my correspondence to this case followed the official channels, Microsoft Security Response Center, where I got a case number, and 2 times was asked to delay the release/disclosure which I fully respected.


Comments

Post a Comment

Popular posts from this blog

Microsoft AzureAD and Office365 - Not secure by default

Image
Microsoft AzureAD and Office365 - Not secure by default Or 3 clicks and you are dead Cloud Identity is a great thing these days. You can sign up to lots of services using your social identity from Facebook, Google, or from Microsoft. You do not have to invent new passwords (or reuse passwords used elsewhere), and you get easy Single Sign On. This has more advantages than drawbacks for by far the majority of users. The purpose of this article is to create awareness of some of the dangers. Microsoft AzureAD - The special case Your Microsoft company identity is just another cloud identity for most services, and in many ways it is better than some of the others. You get secure multi-factor logon, you might even get passwordless logon. Conditional Access to protect your Sign in attempts even more, maybe blocking countries like China, Russia and Brazil, or doing it risk based. It all depends an how the enterprise has configured things. It is trivial to create your own web server, ...
Read more

Can you verify Cloud App vendors ?

Image
Evaluating cloud app vendors After discovering that users could authorize 3rd parties to access enterprise data by just 3 clicks, we started to look at who people had actually given access to. One such 3rd party was Boomerang aka Baydinc. I remember I have seen the name before. I do not know the company, but we have a few happy users of their product. This blog article is about how to judge if a plugin should be allowed or not, or if it is even possible to make this judgement. This article uses Boomerang for Outlook as an example, and looking with paranoid glasses, it would be a clear no. But that would be based on stereotypes, prejudice etc. The unbiased conclusion is, that it is impossible to evaluate. Outloook Add-In Store In the store, it only gets a 3 start review. This might be a warning indicator.  Next, looking at what permission it needs, Microsoft clearly writes it can access and modify personal information in THE active message. Installing it, and ...
Read more