Abstract
Azure AD guest accounts are widely used to grant external parties limited access to enterprise resources, with the assumption that these accounts pose little security risk. As you’re about to see, this assumption is dangerously wrong. In this talk, we will show how guests can leverage undocumented APIs to bypass limitations and gain unauthorized access to sensitive business data and capabilities including corporate SQL servers, SharePoint sites, and KeyVault secrets. Furthermore, we will reveal how guests can create and control internal business applications to move laterally within the organization. All capabilities presented in the talk will be demonstrated with the default Office 365 and Azure AD configuration. Next, we will drop PowerGuest, a powerful tool designed to uncover the true scope of guest access in your tenant. PowerGuest can automate limitation bypass, enumerate and dump all accessible data, and allow for interactive non-read actions by the researcher. Finally, we will make up for shattering the illusion of guests having limited access by sharing concrete steps to harden your Azure AD and Office 365 configurations to prevent such attacks and suggest detection logic to catch them if a change in configuration is not possible.
Transcript
AI generated from recording.
Introduction & Guest Access Overview
00:02 Presenter: So, when you get an invite to be guest in somebody else’s tenant, you get this email. I’m sure you’re probably familiar with this email. And once you click on accept, you typically see nothing, right? So you see an empty screen because, well, guests have access to nothing by default, right? So, no, that’s completely wrong.
00:25 Presenter: what we’re going to see today
00:27 Presenter: is that guests can actually get access
00:29 Presenter: to a bunch of overshared credentials,
00:32 Presenter: applications, and automations
00:33 Presenter: that they can just pick up and use.
00:34 Presenter: You’re seeing resources from SQL Server, Azure.
00:38 Presenter: And we won’t stop there.
00:40 Presenter: We also show that these guests can use these credentials
00:43 Presenter: to get full dumps of the data sources there.
00:47 Presenter: All right.
00:48 Presenter: So now that I hopefully have your attention,
00:52 Presenter: hi, everyone.
00:52 Presenter: My name is Michael.
00:54 Presenter: I’ve been focused on security for low-code, no-code apps
00:57 Presenter: for like four or five years now,
00:59 Presenter: co-founded a company in this area called Xenity,
01:01 Presenter: and I’m hiring.
01:02 Presenter: So if you’re looking for an interesting challenge,
01:04 Presenter: reach out to me afterwards.
01:06 Presenter: And if you can please have the slides on the monitor,
Why Guest Access Exists & Onboarding
01:09 Presenter: that would be helpful.
01:10 Presenter: Thank you.
01:11 Presenter: All right.
01:13 Presenter: So I think we have to start by figuring out
01:17 Presenter: why does this mechanism of guests even exist,
01:20 Presenter: because otherwise we won’t understand
01:23 Presenter: So let’s start with that.
01:25 Presenter: When you need to share resources between different organizations,
01:31 Presenter: you’re kind of in a pickle.
01:32 Presenter: So I work for a very small company, about 25 employees,
01:36 Presenter: and we work with large enterprises.
01:37 Presenter: So you start collaborating,
01:40 Presenter: and you need to collaborate over a bunch of files, right?
01:43 Presenter: You have legal documents.
01:44 Presenter: You have a bunch of decks you want to share.
01:47 Presenter: How would you do that?
01:48 Presenter: So there are a few ways for you to do that in a way that’s safe.
01:53 Presenter: one option is, well,
01:55 Presenter: just to send the files over email, and
01:57 Presenter: we’ve probably all done that, right?
02:00 Presenter: That’s not really
02:01 Presenter: advisable, but, well.
02:03 Presenter: Another option is just to
02:05 Presenter: trust somebody on the internet, like
02:07 Presenter: drag and drop it somewhere. You can use
02:09 Presenter: a random service that you find, and
02:11 Presenter: you’ll find that this works.
02:13 Presenter: Again, I’m not sure how safe it is.
02:15 Presenter: You can also do this in real life. This is actually
02:17 Presenter: a real thing that I discovered preparing
02:19 Presenter: for this talk. You can just plug in
02:20 Presenter: your laptop into these USBs. This is a really
02:23 Presenter: project, check it out. But like, kidding aside, if you’re in an enterprise and you want to do this
02:28 Presenter: right, then Microsoft offers for you a way to basically invite guests in. So you bring the guests
02:35 Presenter: into your tenant in hopes to have better controls. This is how this mechanism works. So it has a
02:41 Presenter: couple of things. One is that external users can bring their own identities. That means that they
02:46 Presenter: can authenticate however they choose, right? And the other thing that’s important is that you still
02:53 Presenter: within the tenant.
02:54 Presenter: All right.
02:55 Presenter: So in order for this mechanism to be useful,
Guest Exploitation Basics
02:57 Presenter: to really work in a safe way,
02:59 Presenter: two things need to happen.
03:00 Presenter: One is that it needs to be super easy
03:02 Presenter: for a vendor to onboard,
03:03 Presenter: and the other is that it needs to be super easy
03:05 Presenter: for IT and security to actually control what’s going on.
03:08 Presenter: All right?
03:09 Presenter: So let’s go through both of them.
03:12 Presenter: First of all,
03:13 Presenter: and if we can try to get this video working, thank you,
03:17 Presenter: getting a guest access into an organization
03:19 Presenter: is relatively easy.
03:21 Presenter: You can see here a bunch of examples
03:23 Presenter: works, but if you have a Teams channel, if you have a SharePoint site, then you can just
03:28 Presenter: type in somebody’s email, and once you do that and you click on a few buttons, then
03:33 Presenter: that person will get invited as a guest to your tenant.
03:35 Presenter: The important thing to remember is that the people that are making those decisions are
03:40 Presenter: business users, right?
03:41 Presenter: Those are typically not IT administrators that are enabling this guest access, but just
03:47 Presenter: people that want to enable whatever they’re doing at the time, like the collaboration
03:51 Presenter: that they’re having.
03:53 Presenter: getting guest access is relatively easy.
03:56 Presenter: In some cases, it might even be too easy.
04:00 Presenter: So last year at Black Hat,
04:02 Presenter: check out this amazing talk.
04:04 Presenter: They can show that you could hijack invites
04:09 Presenter: to guest accounts that were not redeemed yet
04:12 Presenter: and then redeem them with a different email.
04:15 Presenter: So every user in the organization
04:16 Presenter: could query Microsoft APIs
04:18 Presenter: to fetch all of the invites
04:21 Presenter: that were not redeemed yet,
04:23 Presenter: Then grab them and reuse them with a different email.
04:26 Presenter: Now, this vulnerability is already resolved.
04:28 Presenter: Don’t worry.
04:29 Presenter: But it does show that the ability of people to accidentally get invited as a guest to your tenant is pretty huge.
04:38 Presenter: There’s also self-service mechanism.
04:40 Presenter: So there’s a lot of ways for that to happen.
04:42 Presenter: And so check out this talk.
04:44 Presenter: It’s really cool.
04:45 Presenter: So we covered the first thing, easy for vendors to onboard.
04:49 Presenter: Now we need to figure out how does IT security supposed to control this thing.
04:53 Presenter: And so let me show you how this works.
04:56 Presenter: It starts with the vendor having some sort of an authentication mechanism on the left side.
05:03 Presenter: So they could use any IDP.
05:06 Presenter: It could be Okta, another AAD tenant.
05:09 Presenter: I mean, anything works here.
05:10 Presenter: And the way that this works for them to connect to your tenant is through a link.
05:16 Presenter: So Azure AD would trust your tenant, would trust their tenant to authenticate you.
05:23 Presenter: about this is that the entire
05:25 Presenter: Microsoft suite of security services
05:27 Presenter: operate on top of that. So if you have single
05:29 Presenter: sign unconditional access
05:31 Presenter: policies, all of these things, you can
05:33 Presenter: apply them to guests the same way
05:35 Presenter: that you can apply them to your own organization,
05:37 Presenter: to your own users, which is really awesome.
05:40 Presenter: And so
05:41 Presenter: one thing that we need to figure out, though, is that
05:43 Presenter: well, in order to give
Power Platform Credentials & DLP
05:45 Presenter: a guest access to someone, we really
05:47 Presenter: need security controls, right? Because we can’t just
05:49 Presenter: invite a guest to our tenant.
05:51 Presenter: In order to get those security controls,
05:53 Presenter: We need to provision those users with an AID account.
05:57 Presenter: Otherwise, those security controls don’t apply.
06:00 Presenter: Right?
06:01 Presenter: But then, does this mean that they get full access?
06:04 Presenter: Because once I give somebody access to my Azure AD account,
06:07 Presenter: I will get full access, like, to the tenant?
06:10 Presenter: All right, so no.
06:11 Presenter: Actually, what happens here is that this is not full access.
06:15 Presenter: This is an access that should be denied by default.
06:18 Presenter: So as a guest, by default, you should have access to nothing.
06:21 Presenter: Nothing at all.
06:23 Presenter: something with you specifically, explicitly,
06:25 Presenter: then you should have access.
06:27 Presenter: Alright, so a quick recap.
06:29 Presenter: Guests are really easy to attain,
06:32 Presenter: they are really easy to control,
06:35 Presenter: and access is denied by default.
06:36 Presenter: And now, once we cover the docs,
06:40 Presenter: let’s talk about reality.
06:41 Presenter: Alright?
06:42 Presenter: So here’s reality.
06:44 Presenter: Let’s start by inviting a guest to our tenant,
06:47 Presenter: and what you’re seeing here,
06:49 Presenter: I’m going to be logged into two different users.
06:53 Presenter: the trusted user, the business user,
06:55 Presenter: and the other would be the hacker.
06:57 Presenter: And you can see this icon, this blue icon
06:59 Presenter: on the right button side, that’s the trusted user’s icon.
07:02 Presenter: And in a moment, you’ll see the hacker icon.
07:03 Presenter: But that would allow you to understand always
07:05 Presenter: which user I’m authenticated with.
07:07 Presenter: All right.
07:08 Presenter: So as the trusted user, I’m in Teams.
07:11 Presenter: I’m just going to invite somebody into my Teams channel.
07:15 Presenter: Why not invite a hacker at Pontoso at Microsoft.com?
07:20 Presenter: And once I’ve done that, I click on that invite.
07:23 Presenter: This person is invited.
07:24 Presenter: Now, logged in as the hacker, and you can see the hacker icon right now,
07:29 Presenter: I’m logging into my own account in my own tenant.
07:32 Presenter: And accepting the invite, I get this ask to provision the guest tenant
07:37 Presenter: with permissions to fetch some basic information about my account.
07:41 Presenter: And once I log in, of course, I don’t see anything, right?
07:45 Presenter: Guests should be denied by default.
07:47 Presenter: And now, very briefly, we already know from the security perspective
07:53 Presenter: to exploit guest access.
07:55 Presenter: So one thing that we’ve seen is that once a guest is invited into a tenant,
07:59 Presenter: you can use Teams, and then it allows you to do some sophisticated fishing
08:03 Presenter: through Teams, and check out this link here.
08:05 Presenter: The other thing that you can do is some recon on the actual directory.
08:09 Presenter: So a guest could, by sophisticated methods, find out information about the users
08:14 Presenter: that are part of your directory.
08:15 Presenter: We have kind of lived with these things.
08:18 Presenter: We know that they exist, but we still provision guest access because, well,
08:22 Presenter: it’s useful.
08:23 Presenter: But actually, as hackers, hackers want more, right?
08:27 Presenter: The idea that just where this ends is not good enough for hackers,
08:32 Presenter: and so they will try to get more than that.
08:35 Presenter: They will try to get into your data.
08:37 Presenter: So this is the point in the talk where I’m going to give you an option
08:41 Presenter: because after the next slide, you’re going to know, right?
08:46 Presenter: And you’ll probably have some work to do on Monday.
08:50 Presenter: so if you don’t want to do that
08:52 Presenter: I really invite you to have an early lunch
08:55 Presenter: any takers?
08:58 Presenter: alright
08:58 Presenter: so I’m just going to click on this link
09:00 Presenter: as the hacker
09:02 Presenter: this takes me to a service called
09:04 Presenter: Microsoft Power Apps
09:05 Presenter: and it’s inviting me in
09:07 Presenter: and once I click on the button here
09:10 Presenter: then I get to this disconnect
09:12 Presenter: and this is telling me basically
09:13 Presenter: the link that you’ve entered which has the environment
09:16 Presenter: on the guest tenant
09:18 Presenter: there’s some confusion, it’s not in your tenant.
Token Exchange & Programmatic Access
09:21 Presenter: So fine, I’m logged into,
09:22 Presenter: it routes me to my own tenant,
09:24 Presenter: my home tenant, all right?
09:26 Presenter: And you can see that this is a full portal,
09:28 Presenter: but it has nothing.
09:29 Presenter: But then I can very, so we’re here,
09:31 Presenter: I’m in the Pontoso tenant, the hacker tenant.
09:34 Presenter: And then I can very easily
09:35 Presenter: just switch to another tenant, all right?
09:38 Presenter: And you’ll see here all of the different tenants
09:40 Presenter: that I have access to.
09:41 Presenter: Because as a guest, I can just switch
09:43 Presenter: to a tenant where I’m a guest in.
09:45 Presenter: And when I switch to that tenant right now,
09:48 Presenter: would take me to the link that I showed you earlier.
09:50 Presenter: Here’s what I see.
09:53 Presenter: I see a bunch of credentials.
09:55 Presenter: And you can see that
09:56 Presenter: this page is in a
09:58 Presenter: service called Power Apps, something
10:00 Presenter: called Connections. We’ll figure that out
10:02 Presenter: in a moment. Those connections are actually
10:04 Presenter: wrappers around credentials. And you can see here
10:06 Presenter: SQL Server and Azure
10:08 Presenter: Storage and a whole bunch of things. Let’s try
10:10 Presenter: and figure out what this actually is.
10:12 Presenter: So let’s just click on one of them. This is
10:14 Presenter: Azure File Storage. I’m gonna
10:18 Presenter: like in this little menu here,
10:21 Presenter: that there are a few options I can use.
10:23 Presenter: The first option that’s kind of weird
10:25 Presenter: to see on credentials is a share button.
10:29 Presenter: A share button on a credential is very weird, right?
10:32 Presenter: Let’s see what this does.
10:34 Presenter: So this specific credential
10:36 Presenter: is shared with three different entities.
10:38 Presenter: One is org.
10:40 Presenter: We’ll get back to that in a moment.
10:42 Presenter: The other is Jamie Redding.
10:43 Presenter: You’ll see that that’s the person
10:44 Presenter: who’s created this connection.
10:46 Presenter: And the third one is Jamie Redding
10:48 Presenter: at Outlook, so Jamie’s
10:50 Presenter: personal account.
10:51 Presenter: And now we understand
10:55 Presenter: somewhat why are we
10:56 Presenter: even seeing this here.
10:57 Presenter: Because Jamie has shared this credential
10:59 Presenter: with the entire org.
11:02 Presenter: The entire org means everybody in your
11:04 Presenter: Azure AD tenant. That includes guests.
11:06 Presenter: That includes everybody.
11:07 Presenter: And that’s a decision that
11:10 Presenter: Jamie has made. So let’s try and figure out
11:12 Presenter: what this credential actually does.
11:14 Presenter: So why is Jamie creating this credential?
11:17 Presenter: All right.
11:17 Presenter: Going to details, I can see a bunch of information
11:20 Presenter: about this credential, like when it was created
11:22 Presenter: and who created it.
11:23 Presenter: Indeed, we’re seeing Jamie.
11:24 Presenter: And just let’s figure out who Jamie is.
11:28 Presenter: So Jamie is actually working for a customer service.
11:32 Presenter: So Jamie is a business user.
11:34 Presenter: Jamie has created an app, and that app required credentials.
11:38 Presenter: So Jamie added those credentials.
11:40 Presenter: And then Jamie wanted to share this app with everyone
11:44 Presenter: because it’s a useful app.
11:46 Presenter: Well, the credentials were shared underneath.
11:49 Presenter: And so Jamie, a business user, had to make a decision.
11:52 Presenter: So she made the wrong decision.
11:54 Presenter: But, well, she’s a business user, right?
11:57 Presenter: And so, not sure if this is going to work.
12:00 Presenter: Can we try and get the video to work?
12:11 Presenter: All right.
12:13 Presenter: I’m going to let you try.
12:16 Presenter: I’m not sure if you’re aware of this, but business users are actually creating full-blown applications on top of your Microsoft instances.
12:24 Presenter: So there’s a thing called Power Platform, which is a low-code, no-code platform baked into Office 365.
12:30 Presenter: It allows business users to build their own applications and automations.
12:33 Presenter: This is amazing, right?
12:35 Presenter: This puts a lot of power in the hands of business users.
12:38 Presenter: The video that I’m not able to show you right now shows that users can actually use a chat interface, an AI interface.
12:46 Presenter: That’s with the text, they send text messages,
12:49 Presenter: and the bot underlying would create a table in a database,
12:53 Presenter: an application on top of that.
12:55 Presenter: You can share that application forward.
12:56 Presenter: Imagine like every conversation you had with ChatGPT
13:00 Presenter: leaves behind an application that now lives.
13:02 Presenter: It’s a thing.
13:04 Presenter: It can even persist after the user has left the organization.
13:08 Presenter: So this is actually going on right now
13:09 Presenter: within most large organizations
13:12 Presenter: because this is really useful.
13:13 Presenter: Business users are creating really useful applications.
13:16 Presenter: And one thing you could do right now to try and kind of get yourself off the hook is to think that this is probably small.
13:24 Presenter: This probably doesn’t belong to your organization.
13:26 Presenter: So I’m sorry to burst your bubble.
13:29 Presenter: This is the number of .NET developers today, according to Microsoft.
13:33 Presenter: You can see 5 million.
13:35 Presenter: 5 million .NET developers.
Tool Demonstration & Capabilities
13:37 Presenter: How many developers do you think are using this low-code, no-code?
13:40 Presenter: Like, how many business users are building applications?
13:44 Presenter: Just have a number in your head.
13:46 Presenter: All right, so I went through Microsoft earning reports
13:48 Presenter: to try and figure that out,
13:50 Presenter: and according to the estimation that I have here,
13:53 Presenter: like the small regression here, about 8 million.
13:57 Presenter: How many security resources are we investing
14:00 Presenter: in what .NET developers are building?
14:02 Presenter: And then compare that to what business users are building.
14:05 Presenter: Well, we’re not in a good situation.
14:07 Presenter: All right, so now that we figured out that this is big
14:09 Presenter: and this is happening in any organization,
14:11 Presenter: now we’re going to get to the fun part
14:13 Presenter: because we’re going to see how we can exploit this thing.
14:16 Presenter: Okay.
14:17 Presenter: So, logging in as the hacker,
14:19 Presenter: I go to this Azure file storage thing,
14:22 Presenter: and now there’s a tab here called applications
14:24 Presenter: that use this connection.
14:25 Presenter: I want to see what data lies behind this connection,
14:28 Presenter: this credential.
14:29 Presenter: So, there’s an application here.
14:31 Presenter: Let’s try to open up that application.
14:33 Presenter: It takes me to a page which gives me
14:35 Presenter: a bunch of information about that app,
14:37 Presenter: and you can see that there’s a link there
14:38 Presenter: that I can click to to get into the app.
14:41 Presenter: And once I click on that link,
14:43 Presenter: I get an issue.
14:45 Presenter: And that issue, I’m not sure if you can see this,
14:48 Presenter: but this issue is basically telling me,
14:49 Presenter: hey, you don’t have the right license.
14:51 Presenter: You don’t have the license to be able to use this application.
14:55 Presenter: And, I mean, it makes sense, right?
14:57 Presenter: I’m a guest.
14:58 Presenter: By default, I have access to nothing at all.
15:00 Presenter: And so why would I have a license to log into that?
15:03 Presenter: So here’s the clue.
15:05 Presenter: You already have it on screen.
15:07 Presenter: Here’s the clue of how we’re going to bypass this.
15:09 Presenter: And I’ll try to read this out to you.
15:11 Presenter: Maybe here it would be easier.
15:13 Presenter: You don’t have the correct plan to access this app.
15:16 Presenter: Ask your admin for one,
15:17 Presenter: or ask the admin at the organization in which you’re a guest.
15:22 Presenter: So can you guess how we’re going to bypass this?
15:25 Presenter: What happens if we have a license in our own tenant?
15:28 Presenter: Would this work?
15:28 Presenter: Nah.
15:29 Presenter: I don’t think this will work.
15:31 Presenter: Let’s try.
15:32 Presenter: Here’s a way for you to get a free plan from Microsoft,
15:37 Presenter: a free license in your own tenant.
15:39 Presenter: So I’m going to ask nicely for Microsoft for a license.
15:44 Presenter: Hi, I’m a hacker.
15:45 Presenter: Please give me a license.
15:46 Presenter: And they’re going to say, yeah, okay, fine.
15:48 Presenter: Here’s a license.
15:48 Presenter: And now I have a license in my home tenant.
15:51 Presenter: And I go back to that app.
15:53 Presenter: And now I’m in.
15:54 Presenter: Because if you have a license in your own tenant, that’s fine.
15:57 Presenter: And you can use it for the guest tenant as well.
16:00 Presenter: All right.
16:01 Presenter: So once this continued to Lowe’s, we actually hit another wall.
16:05 Presenter: and this is now telling me something very different.
16:08 Presenter: It’s telling me that it looks like this app
16:10 Presenter: isn’t compliant with the latest data loss prevention policies.
16:14 Presenter: Let’s open this up.
16:16 Presenter: And it’s telling us this is something about
16:18 Presenter: data loss prevention, deny Azure file storage.
16:23 Presenter: Is there like a, this looks like there’s a DLP policy
16:27 Presenter: built into this local, local platform, to Power Platform.
16:31 Presenter: I mean, DLP, let’s try to figure out
16:36 Presenter: So, indeed, there’s something called DLP policies within this platform that allows you to control what users can and cannot create.
16:45 Presenter: So, well, this is great.
16:47 Presenter: Let’s try to create.
16:48 Presenter: Let’s log in as the trusted user and try to create a policy that would find social security numbers and then block, like, the usage of those.
16:57 Presenter: All right.
16:57 Presenter: Let’s do that.
16:59 Presenter: Oh, but now it’s showing me that I need to choose a bunch of connectors.
17:03 Presenter: Let’s choose SharePoint.
17:06 Presenter: I can block SharePoint.
17:08 Presenter: I mean, I can move into business.
17:10 Presenter: So something is actually going on here.
17:14 Presenter: The crucial piece to understand
17:15 Presenter: is that this is not the DLP you’re thinking about.
17:19 Presenter: This is a security mechanism,
17:20 Presenter: but it’s not a security DLP
17:23 Presenter: like you’re used to thinking about DLP.
17:25 Presenter: It’s not looking for patterns in data.
17:27 Presenter: It’s actually allowing you to set which connectors
17:29 Presenter: are allowed to operate or denied to operate.
17:32 Presenter: So, for example, you could say,
17:35 Presenter: where nobody could use OneDrive,
17:37 Presenter: you can see that some connectors are not blockable at all,
17:39 Presenter: for example, SharePoint.
17:41 Presenter: And there are more sophisticated mechanisms there,
17:43 Presenter: but the gist of it is kind of an allowed denialist
Mitigations & Defenses
17:47 Presenter: with some sophisticated features about kind of endpoints.
17:51 Presenter: All right, so this is actually not really a security mechanism, okay?
17:56 Presenter: Because one of my hobbies in the last year or so
17:59 Presenter: has been to try and find ways to go around this mechanism,
18:02 Presenter: but in a way that’s like just a creative usage of applications within this platform.
18:10 Presenter: So currently, I know of five ways to try and bypass this through creating an app that calls another app.
18:21 Presenter: I mean, most of these things, if you really, really try, you can try and block them.
18:26 Presenter: The issue with DLP policies here is that, I mean, it’s a great mechanism.
18:32 Presenter: to make sure that business users are making less mistakes.
18:35 Presenter: But this would not block the hackers.
18:38 Presenter: This would not block somebody that really wants to push forward.
18:44 Presenter: And so even though we talked a bit about this DLP policy,
18:48 Presenter: I’m still stuck, right?
18:50 Presenter: Because we just saw that I need to open an application,
18:53 Presenter: and I tried to open the application.
18:55 Presenter: I was blocked by DLP.
18:57 Presenter: And so unfortunately, I can’t share a lot of details
18:59 Presenter: on this specific issue right now
19:02 Presenter: and we’re going to fix some issues, so that’s great.
19:05 Presenter: And so I’m going to ask you to kind of allow me to move to the next point.
19:10 Presenter: And if you’re interested, I’ll share more details once I can.
19:14 Presenter: Microsoft is working on making this better.
19:17 Presenter: All right.
19:18 Presenter: So we were blocked by DLP when we tried to get into the Azure file storage information.
19:25 Presenter: Fine.
19:25 Presenter: Let’s just go to another connection.
19:27 Presenter: So here’s the second credential here.
19:29 Presenter: It’s a SQL credential.
19:30 Presenter: Let’s open it up.
19:32 Presenter: by Jamie. Now, going to applications,
19:35 Presenter: I can see a bunch of applications.
19:37 Presenter: Here’s one of them. And then
19:38 Presenter: again, I’m going to go to that app.
19:41 Presenter: I’m going to click on that link.
19:42 Presenter: And now, I’m actually logged into the app
19:45 Presenter: because this app lets
19:47 Presenter: me log in. And the first thing that it asks me
19:48 Presenter: is to kind of which connection,
19:51 Presenter: which credential I’m going to use. And this is the
19:52 Presenter: credential I’m going to use. Alright.
19:54 Presenter: And once I get into the app,
19:57 Presenter: here’s what I see. This is the actual application.
19:59 Presenter: It has a bunch of customers.
20:00 Presenter: You can see that this is showing me a table like
20:02 Presenter: PBOs or customers, and there are a bunch of customers here.
20:06 Presenter: And when I click on each one of the lines here,
20:10 Presenter: then I get information about that customer,
20:12 Presenter: including personal information and social security numbers.
20:15 Presenter: And don’t worry, this is all generated by ChatGPT,
20:17 Presenter: so nothing to see here.
20:20 Presenter: So let’s try and figure out how does this application work.
20:23 Presenter: How does it get the data that we’re seeing right here?
20:27 Presenter: So if we look at the request,
20:29 Presenter: this is the request that’s actually going out
20:33 Presenter: information on behalf of power-ups
20:36 Presenter: that gets
20:37 Presenter: this data for us.
20:39 Presenter: And looking at
20:40 Presenter: where this request is actually going,
20:42 Presenter: we can see
20:44 Presenter: a URL, a header
20:47 Presenter: here that tries to go to,
20:49 Presenter: you can see that it goes to like
20:51 Presenter: APIM something and SQL,
20:52 Presenter: so let’s try and figure out what exactly
20:55 Presenter: this request is. But before
20:57 Presenter: you do that, of course, let’s try and see
20:59 Presenter: whether we can just
21:00 Presenter: use this request. So if we just
21:02 Presenter: copy this request, and of course we
21:04 Presenter: replay it on our own, then
21:06 Presenter: of course we get the data, right? It’s kind of the same thing.
21:08 Presenter: So we copied the data with the token
21:10 Presenter: from the browser, and we see the same thing.
21:13 Presenter: Alright. So this is what we’re after.
21:15 Presenter: Right? Because we don’t
21:16 Presenter: want, as a hacker,
21:18 Presenter: in the hacker mindset, we don’t really
21:20 Presenter: want to use the app to see
21:22 Presenter: the data. We want to be able to see
21:24 Presenter: all of the information behind
21:26 Presenter: that credential, not just the information
21:28 Presenter: that is exposed through applications.
21:31 Presenter: And so this would be the way for us to do that.
21:34 Presenter: And so let’s try and do that.
21:36 Presenter: Here’s this link again.
21:37 Presenter: Let’s try and figure out what’s going on here.
21:39 Presenter: The first line is the domain.
21:42 Presenter: Azure API management is an API gateway, all right?
21:45 Presenter: So everything goes through this API gateway.
21:48 Presenter: That’s fine.
21:49 Presenter: After that, it’s going to a SQL.
21:51 Presenter: Because I’m specifically querying a credential of a SQL server.
21:56 Presenter: And you can see an ID for that specific credential.
21:58 Presenter: and then it’s choosing the relevant
22:01 Presenter: SQL server and SQL database.
22:03 Presenter: So you can see customer inside server,
22:05 Presenter: enterprise customer database
22:07 Presenter: and now there’s the query portion
22:11 Presenter: and let me just fix that URL for you.
Recommendations & Best Practices — Part 1
22:13 Presenter: So you see tables
22:14 Presenter: and there’s the customer table
22:16 Presenter: and I’m iterating through items.
22:18 Presenter: So this is actually allowing power-ups
22:22 Presenter: to fetch information behind this credential.
22:26 Presenter: and this API management instance
22:29 Presenter: is basically a proxy
22:31 Presenter: that allows Power Platform, allows the Power Apps
22:33 Presenter: to fetch information that sits behind those connections
22:36 Presenter: let’s figure out how exactly this works
22:39 Presenter: this is a slide that I’m taking from Microsoft Docs
22:42 Presenter: you can see on the left side
22:44 Presenter: there are the applications, there are the users
22:47 Presenter: there are the automations
22:48 Presenter: and on the right side there’s an API that they want to query
22:50 Presenter: for example an API to fetch information through SQL
22:55 Presenter: management instance there that allows, that facilitates those requests.
23:01 Presenter: And note that when you as a user, when you log into something, then you get generated
23:06 Presenter: some sort of a token, and that’s fine.
23:08 Presenter: You can use the token to reach out to the API.
23:11 Presenter: How would an automation do that behind the scenes?
23:14 Presenter: How would an application do that?
23:16 Presenter: And think again about the fact that the people that are building applications with this thing,
23:20 Presenter: those are business users, right?
23:22 Presenter: But business users don’t have access to create service accounts for themselves.
23:26 Presenter: If you want to allow business users to build applications, you have to allow them to do this with their own identities.
23:33 Presenter: So that’s a lot of what’s going on here.
23:37 Presenter: What’s actually happening with this architecture is that a user would authenticate with their own connection, with their own credential.
23:45 Presenter: It could be a service account as well, but most users use their own identities.
23:49 Presenter: and then they would embed that identity
23:52 Presenter: within the application.
23:54 Presenter: And then once they create
23:56 Presenter: this refresh token or this client secret
23:58 Presenter: or whatever, that gets stored
24:00 Presenter: in a token
24:02 Presenter: database behind this API management
24:04 Presenter: instance and then you can share that.
24:06 Presenter: You can share that with other users.
24:08 Presenter: You can share that with guest users.
24:10 Presenter: You can also share that with an application or an automation
24:12 Presenter: that operates on your behalf
24:13 Presenter: on the backend.
24:15 Presenter: So if you look at it from the identity
24:19 Presenter: to understand. From the identity
24:21 Presenter: perspective, this is user impersonation
24:24 Presenter: in many cases, right?
24:25 Presenter: You will not be able to distinguish an application
24:27 Presenter: or a user using the same credentials.
24:30 Presenter: So this is actually what’s going on
24:31 Presenter: here, and this is what we’re fetching, and
24:33 Presenter: we just saw a get request,
24:35 Presenter: but of course there was many more. We can do a lot of
24:37 Presenter: other things on top of a SQL connection.
24:40 Presenter: So let’s try and take
24:41 Presenter: a deeper look into this
24:43 Presenter: request, because remember, I mean
24:45 Presenter: I just copied this off of the browser, but I need
24:47 Presenter: to be able to query this in
24:49 Presenter: a programmatic way for it to be useful for a hacker.
24:53 Presenter: So here’s the JWT token, and you can see that there’s a specific resource that I need here.
24:57 Presenter: It’s called API Hub at Azure.
25:00 Presenter: And let’s try and figure out whether we can generate this token.
25:04 Presenter: Now, recall that generating token is easy because I have the user, right?
25:08 Presenter: So the problem is just generating the right token rather than just generating tokens.
25:13 Presenter: And so the only thing that we are going to need is to find a client ID, an application,
25:17 Presenter: that will already be provisioned on the guest tenant
25:20 Presenter: that would allow us to create this token.
25:23 Presenter: And so one thing I can try is a built-in public client app.
25:29 Presenter: So just one of the public client apps
25:31 Presenter: that’s already available on the tenant.
25:33 Presenter: And when I try to do that, I actually fail
25:35 Presenter: because, unfortunately, the app needs to be pre-approved
25:39 Presenter: to actually get this resource.
25:40 Presenter: This is an internal resource.
25:42 Presenter: All right, let’s try and do another thing.
25:44 Presenter: Let’s try to create an application,
25:47 Presenter: in our own tenant and give it those permissions,
25:50 Presenter: like grant those permissions in our own tenant.
25:53 Presenter: That doesn’t work as well.
25:54 Presenter: Because you wouldn’t find this permission
25:56 Presenter: in the Entry ID or AID portal
26:00 Presenter: because it’s an internal permission.
26:02 Presenter: Microsoft won’t allow you to do this.
26:04 Presenter: So we’re kind of stuck, which is annoying.
26:09 Presenter: Let’s kind of recap how annoying this is.
26:12 Presenter: Because we got access to somebody else’s tenant.
26:17 Presenter: We saw a bunch of credentials there in PowerApp
26:19 Presenter: just waiting for us.
26:21 Presenter: We tried to get access,
26:23 Presenter: but we were blocked by a license.
26:26 Presenter: So we just got a license.
26:28 Presenter: That’s fine.
26:29 Presenter: We were blocked by DLP.
26:31 Presenter: And then I basically waved my hands
26:34 Presenter: and told you I’ll explain this later.
26:36 Presenter: And then we get blocked by programmatic access
26:39 Presenter: to API Hub,
26:39 Presenter: so we are not able to generate the right token.
26:41 Presenter: And so let’s try to solve that.
26:45 Presenter: What we need is an app that can do three things
26:48 Presenter: It will be on by default
26:50 Presenter: On every tenant
26:52 Presenter: It will be pre-approved
26:53 Presenter: To use this resource to query API Hub
26:56 Presenter: And it will be a public client
26:58 Presenter: Because we need to generate tokens with this app
27:00 Presenter: And so can you think of an app
27:02 Presenter: That might do that for us
27:04 Presenter: So we already know about one app
27:06 Presenter: That is pre-approved to query API Hub
27:09 Presenter: Right?
27:09 Presenter: This is Power Apps
27:10 Presenter: We just saw that
27:12 Presenter: So Power Apps is actually,
27:14 Presenter: another thing is also on by default on every user,
27:17 Presenter: on every account, tenant, sorry,
27:19 Presenter: but of course they’ve done their job well here
27:22 Presenter: and it’s a confidential app,
27:24 Presenter: so you can’t authenticate on behalf of Power Apps.
27:27 Presenter: So we’re kind of in a problem here.
27:29 Presenter: The way that we’re going to solve this
27:31 Presenter: is with a neat piece of research
27:33 Presenter: that shows an undocumented way
27:37 Presenter: in which Microsoft Azure Active Directory behaves.
27:41 Presenter: This is the family of client IDs.
27:45 Presenter: In order to understand that,
27:46 Presenter: think about the experience
27:47 Presenter: where you log into one Microsoft app,
27:49 Presenter: like Teams,
27:50 Presenter: and then you go to Outlook
27:52 Presenter: or you go to any other, like OneDrive.
27:55 Presenter: Are you getting prompted to re-authenticate?
27:58 Presenter: No, right?
27:59 Presenter: The single sign-on still works.
28:00 Presenter: How does that happen?
28:01 Presenter: Those are different domains,
28:03 Presenter: different tokens, different resources.
28:05 Presenter: How does that happen?
28:06 Presenter: Well, the way that it happens
28:08 Presenter: is that you can take one refresh token
28:11 Presenter: from one client ID, from one resource,
28:13 Presenter: and exchange it with another for another client ID,
28:17 Presenter: for another resource, inside of the Microsoft ecosystem.
28:21 Presenter: This is undocumented behavior that was discovered
28:25 Presenter: by people much smarter than I am.
28:28 Presenter: Check out this research. This is really cool.
28:30 Presenter: But the client ID that we are aware of,
28:33 Presenter: that we can exchange as tokens today,
28:35 Presenter: you can see the list on screen right now.
28:38 Presenter: So can you identify the ones that we’re going to use?
28:41 Presenter: First of all, there’s power-ups here, which is great.
28:44 Presenter: But what do we need more?
28:46 Presenter: We need a public client application
28:48 Presenter: where we can just generate how many tokens we’d like
28:50 Presenter: in every tenant.
28:51 Presenter: Do you see one here?
28:54 Presenter: Here it is.
28:54 Presenter: So Azure CLI.
28:57 Presenter: Azure CLI can generate token on behalf of a user
29:02 Presenter: inside of every tenant.
29:03 Presenter: So this will actually solve our problem
29:05 Presenter: because what we’re going to do
29:06 Presenter: is we’re going to log in to Microsoft Azure CLI
29:11 Presenter: to API Hub.
Recommendations & Best Practices — Part 2
29:13 Presenter: All right?
29:13 Presenter: And this will solve all of our problems.
29:16 Presenter: And so now that we have found a way
29:18 Presenter: to circumvent everything that we’ve seen,
29:21 Presenter: we have the ability to programmatically
29:24 Presenter: generate the right token,
29:25 Presenter: to go to this API Hub,
29:27 Presenter: and to be able to query each connection,
29:29 Presenter: each credential we have access to as a guest.
29:31 Presenter: And now let’s see what we can actually do with this.
29:34 Presenter: And I’m going to be very brief here
29:36 Presenter: because we have an arsenal session
29:40 Presenter: later this day, where we’ll share a bunch more information.
29:43 Presenter: So check it out.
29:44 Presenter: But let’s try and look at this.
29:46 Presenter: So we have just released, like a couple of hours ago,
29:49 Presenter: we’ve released a tool called PowerPoint,
29:51 Presenter: which allows you to play around with everything
29:53 Presenter: that you’ve seen in this talk today.
29:55 Presenter: And PowerPoint has different modules.
29:57 Presenter: The modules that we spoke about in this talk right now
30:00 Presenter: is the dump and the GUI modules,
30:03 Presenter: but there are actually others.
30:04 Presenter: So if you’re interested, really check out the SNL talk.
30:07 Presenter: But let’s see what this tool does.
30:09 Presenter: So when I use the dump module,
30:12 Presenter: and I just need to plug in the tenant I’d like to go to,
30:16 Presenter: then it would authenticate to Microsoft Azure CLI
30:22 Presenter: on the hacker’s behalf, which is fine.
30:25 Presenter: And once I do that, we do the exchange of tokens
30:27 Presenter: and everything that you’ve seen in this talk.
30:29 Presenter: And what I get to is this screen
30:31 Presenter: that you saw at the beginning of the talk.
30:33 Presenter: But now we understand what’s going on here.
30:37 Presenter: you can see that there are a bunch of credentials here,
30:39 Presenter: and you can identify the two credentials
30:41 Presenter: that we’ve seen throughout this talk,
30:42 Presenter: but you can also see that I have access
30:44 Presenter: to applications and automations.
30:46 Presenter: I’m not going to show this today,
30:47 Presenter: but you can actually use them.
30:48 Presenter: You can run these automations,
30:50 Presenter: so there are plenty more things you can do here.
30:53 Presenter: But for each one of those connections,
30:55 Presenter: we’re not going to stop with enumeration
30:56 Presenter: because we want to see what’s behind those connections,
31:00 Presenter: not just through apps.
31:01 Presenter: So let’s do that.
31:02 Presenter: So there’s a dump table here for you,
31:04 Presenter: and when I go to a dump for the SQL server,
31:06 Presenter: I would get a dump for each one of the tables
31:08 Presenter: behind the SQL server.
31:10 Presenter: And just going to one of them, the customers table,
31:13 Presenter: which is what I’m actually interested in,
31:15 Presenter: here’s the entire table.
31:20 Presenter: All right.
31:21 Presenter: We will not stop here, because
31:23 Presenter: just getting the
31:25 Presenter: dump of the data is just one thing that we can
31:27 Presenter: do, but we can also do
31:28 Presenter: other operations on top of the database.
31:30 Presenter: We can change information in the database.
31:33 Presenter: We can delete things. We can create
31:34 Presenter: different tables. I mean, why not?
31:36 Presenter: there’s something here called a playground
31:38 Presenter: which actually creates for you a dynamic interface
31:42 Presenter: where you can pass through arbitrary commands
31:45 Presenter: to these credentials.
31:46 Presenter: And in this example, you’re seeing a SQL query,
31:50 Presenter: which you can just pass to the application.
31:53 Presenter: So if you’re interested in this,
31:56 Presenter: check out the tool, check out PowerGuest.
31:59 Presenter: If you’re thinking about how you protect
32:02 Presenter: your organization from this thing,
32:04 Presenter: PowerPoint will help you as well
32:06 Presenter: to identify. You think, you put on your
32:08 Presenter: hacker hat and you see what a hacker
32:10 Presenter: would get to.
32:12 Presenter: Alright.
32:14 Presenter: I think what I’m going to go
32:17 Presenter: through now is probably the most important
32:18 Presenter: thing in this talk, and that’s
32:20 Presenter: how do we defend ourselves from this.
32:22 Presenter: And before I go to specific
32:24 Presenter: recommendations, I would like to acknowledge
32:26 Presenter: that a strong
32:29 Presenter: collaboration that we’ve had with Microsoft
32:30 Presenter: Security Response Team, they’ve been great.
32:32 Presenter: We’ve been collaborating a lot
32:34 Presenter: these recent weeks.
32:36 Presenter: They have, so we’ve been working together to create good mitigations for you, so you’ll see that in a moment, suggesting on what you can do better.
32:44 Presenter: We’ve been working on enabling, on figuring out which defaults can be different to make this problem less severe.
32:51 Presenter: There are currently no vulnerabilities at all.
32:54 Presenter: There’s also a few disclosures that we’re working through, but really, they’ve been great, so thank you for that.
33:02 Presenter: before I go to specific mitigations
33:04 Presenter: we need to figure, we need to understand
33:05 Presenter: the underlying problem here
33:07 Presenter: so when you think about
33:10 Presenter: cloud, there’s an obvious
33:12 Presenter: shared responsibility model
33:13 Presenter: and I’m showing the shared responsibility model here for serverless
33:15 Presenter: and we know that while the platform
33:18 Presenter: is in charge of
33:19 Presenter: building secure building blocks
33:21 Presenter: we are in charge of what we’re building
33:23 Presenter: when we build an app
33:24 Presenter: the only way for us to
33:27 Presenter: actually make sure that app is safe
33:30 Presenter: as well. This is true for low-code
33:32 Presenter: and no-code as well. This is true for what your business users
33:34 Presenter: are building. So you don’t own the code, that’s
33:36 Presenter: fine, but you do own the business logic, you do
33:38 Presenter: own the data and access
33:40 Presenter: to that application. We are not
33:42 Presenter: pulling our part here.
33:44 Presenter: And so when we leave business users to make
33:46 Presenter: decisions on their own, of course, they
33:48 Presenter: might make mistakes because they’re not security
33:50 Presenter: aware, and I’m not sure how much can
33:52 Presenter: they be, right? Because we’re forcing
33:54 Presenter: them to make very tough decisions. So
33:56 Presenter: on this shared responsibility
33:58 Presenter: model, of course we need to push the platforms
34:00 Presenter: to be better.
34:01 Presenter: And I’ve been talking about Microsoft here,
34:03 Presenter: but there are many local and local platforms
34:04 Presenter: that we need to help them be better at this,
34:07 Presenter: provide better controls, better visibility.
34:09 Presenter: Just last week, researchers from Tenable
34:12 Presenter: found a multi-tenant vulnerability within Power Platform,
34:15 Presenter: the same thing that we’ve been discussing about today.
34:18 Presenter: And Microsoft, of course, fixed this already,
34:20 Presenter: and they were great in response.
34:22 Presenter: But it’s important for us to remain vigilant,
34:26 Presenter: to push the platforms to be better.
34:29 Presenter: but it’s also important for us to hold our part
34:31 Presenter: so if you work for a Microsoft shop
34:34 Presenter: for a large enterprise
34:36 Presenter: can you answer these questions
34:38 Presenter: do you know
34:39 Presenter: what applications your business users are building
34:41 Presenter: which data they’re touching
34:43 Presenter: who are they sharing this with
34:45 Presenter: are you leaving your business users
34:48 Presenter: to make decisions
34:49 Presenter: about who they share their app with
34:52 Presenter: on their own
34:53 Presenter: because if you do well
34:54 Presenter: then you shouldn’t expect anything else
34:58 Presenter: So this all translates to AppSec.
35:01 Presenter: We need to bring the business development
35:05 Presenter: under the security umbrella.
35:07 Presenter: And before we do that,
35:10 Presenter: I’m not sure how much we’ll see this improve.
35:13 Presenter: And so let me now move to concrete things you can do.
35:17 Presenter: The first thing is how to build more secure applications.
35:21 Presenter: And the first kind of obvious recommendation,
35:24 Presenter: just don’t share with everyone.
35:26 Presenter: Just don’t share with too many people.
35:28 Presenter: Don’t share with large groups.
35:30 Presenter: We’ve talked about the, like, share with everyone feature here for Power Platform,
35:34 Presenter: but guests can just get access directly.
35:36 Presenter: They can get access through groups.
35:38 Presenter: We’ve seen this happen multiple times in multiple ways.
35:41 Presenter: So just don’t do that.
35:42 Presenter: And by the way, I’m going to give you a few resources here,
35:46 Presenter: and all of the links are below here.
35:49 Presenter: The other thing you can do is you can harden the…
35:52 Presenter: Sorry.
35:52 Presenter: You can make sure that your business users are actually building secure applications.
35:57 Presenter: And if you’re thinking about what does this mean to help business users build secure applications,
36:02 Presenter: what are the problems that can happen, there’s an OWASP project dedicated to this.
36:06 Presenter: So OWASP, local, local, top 10.
36:08 Presenter: Check it out.
Recommendations & Best Practices — Part 3
36:09 Presenter: It provides the risks in two modes.
36:13 Presenter: One is for security folks, and the other, which we just had contributed to the project,
36:18 Presenter: in plain language that you can just send to your business users
36:21 Presenter: and hopefully they’ll be able to understand.
36:23 Presenter: This includes threat scenarios, everything translated to a language
36:26 Presenter: that business users can understand.
36:28 Presenter: Check it out.
36:28 Presenter: It’s the best framework we have today to try and guide those business users
36:32 Presenter: to make better decisions and to try to guide our own AppSec frameworks.
36:37 Presenter: So that’s about building secure applications.
36:40 Presenter: You can also harden your environment.
36:42 Presenter: So one thing you can do is you can change the defaults
36:44 Presenter: because the defaults are on the productivity side
36:49 Presenter: rather than on the security side.
36:50 Presenter: You can change the defaults on Azure Active Directory.
36:53 Presenter: You can change the defaults on Power Apps.
36:55 Presenter: You’re seeing one screenshot here, but just go to the link.
36:58 Presenter: You’ll find there a bunch of information
37:00 Presenter: about the specific defaults that you can change to.
37:04 Presenter: AppSec.
37:05 Presenter: We need to bring business users under the security umbrella,
37:09 Presenter: and AppSec needs to own what those business users are building.
37:12 Presenter: This is not an easy job.
37:14 Presenter: in checking and understanding how this looks like.
37:17 Presenter: How are people succeeding to do this already?
37:19 Presenter: There are organizations that have been able to do this already.
37:22 Presenter: Check out the talk I gave yesterday on the stage, like close here.
37:29 Presenter: Well, you’ll just find it.
37:31 Presenter: All right.
37:32 Presenter: And the last recommendation is hack your own environment.
37:36 Presenter: Because we are already seeing hackers using these techniques.
37:39 Presenter: That’s why it’s important.
37:40 Presenter: That’s why it was important for me to talk to you about it today.
37:44 Presenter: on and hack your own environment and get yourself secured.
37:48 Presenter: Thank you very much.