SVR Attacks on Microsoft 365
FireEye is reporting the current known tactics that the SVR used to compromise Microsoft 365 cloud data as part of its SolarWinds operation:
Mandiant has observed UNC2452 and other threat actors moving laterally to the Microsoft 365 cloud using a combination of four primary techniques:
- Steal the Active Directory Federation Services (AD FS) token-signing certificate and use it to forge tokens for arbitrary users (sometimes described as Golden SAML). This would allow the attacker to authenticate into a federated resource provider (such as Microsoft 365) as any user, without the need for that user’s password or their corresponding multi-factor authentication (MFA) mechanism.
- Modify or add trusted domains in Azure AD to add a new federated Identity Provider (IdP) that the attacker controls. This would allow the attacker to forge tokens for arbitrary users and has been described as an Azure AD backdoor.
- Compromise the credentials of on-premises user accounts that are synchronized to Microsoft 365 that have high privileged directory roles, such as Global Administrator or Application Administrator.
- Backdoor an existing Microsoft 365 application by adding a new application or service principal credential in order to use the legitimate permissions assigned to the application, such as the ability to read email, send email as an arbitrary user, access user calendars, etc.
Lots of details here, including information on remediation and hardening.
The more we learn about the this operation, the more sophisticated it becomes.
In related news, MalwareBytes was also targeted.
Clive Robinson • January 21, 2021 8:54 AM
@ ALL,
There is a saying about not “putting all your eggs in a basket”.
The implication being if the basket breaks, gets dropped, etc then you loose the lot.
Now bearing in mind that is advice to just one entity, what do you say to the very many people putting all of their eggs in one very large basket?
Because when that big basket dreaks or is dropped everybodies eggs get lost.
That’s what happens with federated systems that give individuals cloud services, and one of them looses it’s authentication secret.
You would think that this is obvious, yet people do it all the time, education establishments and even some employers force individuals into this mode of opperation.
We know certainly in the case of Google that every thing that goes there way they regard as their property to do as they like with, thus there is no way the information can be secure.
Thus why do we do it?
In the UK for instance, the House of Commons, decided to put all the Members of Parliment on a cloud based office system that was not actually based in the UK…
Not exactly a bright thing to do as was confirmed in a Commons Select Commity enquirey into GCHQ spying on MPs electronic correspondence.