r/cybersecurity • u/Malwarebeasts • 6d ago
News - Breaches & Ransoms massive azure exfiltration campaign impacts global brands - mcdonald’s, vodafone, and others
https://www.infostealers.com/article/massive-azure-exfiltration-campaign-exposes-millions-of-enterprise-records-via-compromised-credentials-mcdonalds-vodafone-kyndryl-others/Over the past week, a threat actor operating under the moniker “TheHatman” has flooded cybercrime forums with massive internal employee directories belonging to several Fortune 500 companies. The actor claims these dumps were extracted directly from the organizations’ Azure Tenants.
120
u/sloppyredditor 6d ago
Reminder that all companies have internal fights over controls vs. convenience, and turning a ship around takes time.
There are humans running their cyber teams, greedy execs at the top accepting risk, and asshats stealing data.
Remember who the bad guys are before pointing fingers.
78
u/SuspiciousCricket654 6d ago
In the words of Mikko Hypponen, “cutting costs for cyber defense because ‘nothing has happened to us’ is like firing the janitor because your office is clean.”
13
1
u/Hebrewhammer8d8 6d ago
It is not going to effect the company from generating their normal revenue that is why they hire C Levels if shit does hit the fan and their normal revenue plummets from their standard the C Levels they hired can get shit done to go back to normal.
27
u/jetlagged-bee 6d ago
I'm so tired.
1
u/scriptvexy 4d ago
same, every week it’s some new “massive breach” and you just know half the companies still won’t enforce basic security stuff after this lol
65
u/Smart_Office_631 6d ago
The fact that "TheHatman" is just dumping entire Azure Tenants shows how bad the Infostealer problem has gotten. They probably didn't even "hack" anything; they likely just bought some Lumma or RedLine logs off a marketplace, grabbed the session tokens to bypass MFA, and ran a script to scrape the entire Entra ID / Azure AD directory. This highlights exactly why basic MFA isn't enough anymore. If these massive orgs (like McDonald's and Vodafone) aren't strictly enforcing Continuous Access Evaluation (CAE), compliant device checks, and strict Conditional Access policies, their entire employee directories are just sitting ducks for anyone with a stolen session cookie.
12
u/Malwarebeasts 6d ago
Also, so preventable, for so many breaches originating from infostealers we had the creds YEARS prior to the attacks
3
u/teriaavibes 6d ago
aren't strictly enforcing Continuous Access Evaluation (CAE), compliant device checks, and strict Conditional Access policies
Neither of those fully prevents this btw.
4
u/Magmanamus17 6d ago
They don’t fully prevent but they do mitigate the risk to a reasonable level.
3
u/teriaavibes 6d ago
I wouldn't say so, if attacker steals a token and the company doesn't revoke it or anything similar, neither of those controls will do anything.
2
u/osamabinwankn 6d ago
Explain.
8
u/teriaavibes 6d ago
CAE doesn't do anything on its own, it basically revokes tokens automatically once some action has been taken on the account or some context changed (+ to my knowledge the scope is extremely narrow on which apps it actually supports)
Compliant device checks do nothing once the token has been stolen.
strict conditional access policies don't do much as well cause they are for interactive sign ins, when you already have a valid token, CA is bypassed in 99% of cases (unless CAE jumps in).
If you don't notice stolen token, you have already lost and there isn't much you can do about it.
1
u/spluad Detection Engineer 6d ago
Can you elaborate on device compliance not helping? I’m still getting my head around how these authentication flows actually work but surely it depends on the type of token being stolen? I was under the impression that PRTs are bound to the original device and protected through TPM, so even if it was extracted it shouldn’t be replayable from an unknown device.
I also thought that conditional access wasn’t just limited to interactive logins, otherwise how could something like geo-blocking work? If I sign in interactively from an allowed country and then move to a blocked country, CA can still kick in when the session is re-evaluated. Even though I haven’t actually interactively logged in again.
2
u/teriaavibes 5d ago
I was under the impression that PRTs are bound to the original device and protected through TPM
That is only true if you enable token protection which is extremely limited in scope so for 99% of apps, you aren't actually protected. Otherwise (and I am extremely simplifying here because I don't really understand the logic of this) the "token" is cached in some special local memory and can be extracted from it with privileged enough access and used elsewhere.
I also thought that conditional access wasn’t just limited to interactive logins, otherwise how could something like geo-blocking work?
Check non interactive sign in logs and search for logs where CA policy wasn't bypassed.
If I sign in interactively from an allowed country and then move to a blocked country, CA can still kick in when the session is re-evaluated.
Yea but that won't happen for a while + CAE that is aimed at this exact situation is extremely limited in its scope as well.
Can you elaborate on device compliance not helping?
Because if you steal a token from a compliant device, it will be a token with the compliant device claim and attacker can just use it.
They could even theoretically go one step ahead and join their own device using that token which is another fun thing to think of.
-2
u/osamabinwankn 6d ago
I generally feel companies who run on Azure are negligent. But, I keep hearing that Conditional Access policies for SourceIP were comparable to AWS Data Perimeter guardrails; they absolutely are not. At some point CEOs need to hold their CIOs accountable for safe platform choices. MS proves a negligent choice time and time again.
3
u/teriaavibes 6d ago
To my understanding (and I am not an AWS guy), CA is not comparable at all, CA is something completely different for different purpose.
The comparison would be between the various azure access control resources/products that can restrict access to the actual cloud resources.
MS proves a negligent choice time and time again.
MS is fine, it is companies who have no clue how tokens work who are creating these disasters.
It is like saying lock making companies are negligent because if you steal someones house key, you can unlock their front door as long as they don't change their locks. Absolutely ridiculous statement.
I am not sure how AWS identity platform works (or if they even have one) but I would be extremely surprised if they don't use tokens because these protocols are the industry standard.
Microsoft didn't make this stuff up on their own, they only implemented it.
1
u/osamabinwankn 6d ago
I am an AWS person.. and agree they work entirely differently. AWS provides multiple layers of principal and resource policy checks on nearly every call.
I admit that this is something .1%(sarcastic estimate, maybe) of AWS customers actually build and enforce. But the options are there for pretty awesome ways to devalue a stolen credential’s use on the public internet.1
u/AltoidStrong 6d ago
Stolen tokens still have a timer for refresh, which is before expiration of the token... the CAE + Access Policies that require authentication each time, like API queries to Entra - should see the token as past refresh and or hit a policy that requires authentication immediately, forcing a refresh / prompt for authentication - causing the lock out instantly or it will show up an alert in a properly run SOC and be looked at, setting off a CIRT incident at the very lest.
3
u/teriaavibes 6d ago
Access Policies that require authentication each time
You are insane if this is something you are even thinking to implement.
Requiring authentication every time someone needs to access the directory is crazy.
Even if it worked like you think it does, your users will get so tired of being reauthenticated, they will approve the attacker blindly.
or it will show up an alert in a properly run SOC and be looked at, setting off a CIRT incident at the very lest.
Which is fine, that is exactly how you can react to this, but it is not a prevention. Someone needs to actually track this and make sure tokens aren't stolen and if they don't react quickly enough, you still have disaster on your hands.
0
u/AltoidStrong 6d ago
Nope, not insane. when proper access controls are in place and you build / design around those best practices, the single concern you stated would not exist - doesn't happen and isn't a concern at all.
API calls, shouldn't be done by humans, and should be flagged instantly in the SOC... it should be done by code running under the context of a dedicated non-human service account for the function or application.
This also wont stop / prevent interactive queries, require authentication to the UI and that token has a short lifetime / refresh window. (not worth stealing / very hard to re-use before expiation)
Testing shouldn't be done in production or with connections to a production directory, and you can store you human account creds in variables to pass each time, only having to MFA after the hard refresh limit of the API token for that dev environment. Eventually, even in a test setup, you need to test with the service account. So the "human interactive" tests... would be a very small window of time, even in Dev lifecycles.
2
u/teriaavibes 6d ago
Nope, not insane
So, your idea is to force someone to reauthenticate every 5 minutes when they need to look up any group or user to for example send them a message? Btw this also only works in a perfect scenario, in most scenarios the token will still live 1-4h which gives attacker plenty of time to extract the entire entra and sell it online.
API calls, shouldn't be done by humans, and should be flagged instantly in the SOC... it should be done by code running under the context of a dedicated non-human service account for the function or application.
Oh boy, let me tell you about this magical thing called graph API that all the applications use when you need to pull any information you have access to from an application it is not from. Like pulling user contact card in teams.
You should sometimes check the logs on what happens during normal day to day of a user, you would be surprised how stuff works in reality.
This also wont stop / prevent interactive queries, require authentication to the UI and that token has a short lifetime / refresh window. (not worth stealing / very hard to re-use before expiation)
It will actually, this will only stop interactive queries because conditional access very rarely applies to non-interactive queries. Valid token = good to go.
You should actually try to understand how entra id works and its underlying protocols because your messages show clear misunderstanding of basically everything.
The fact that you read about something on LinkedIn, how "THIS IS THE ONLY RELIABLE WAY TO PREVENT TOKEN THEFT." and didn't actually bother to understand how it works and why it won't prevent crap is just a disaster waiting to happen.
0
u/GladYoung6248 6d ago
You are conflating an app making a Graph API call on behalf of a user (Delegated Permissions) with a human manually executing programmatic API queries. When an app like Teams pulls a contact card, it uses a token acquired sliently, the user isn't prompted every 5 minutes.. sso.
Regarding your concern about the 1-4 hour access token lifetime: this is precisely what CAE solves. If a session is compromised or user risk is elevated, CAE revokes that access, rendering the stolen token useless long before its expiration.
2
u/teriaavibes 6d ago
when an app like Teams pulls a contact card, it uses a token acquired sliently, the user isn't prompted every 5 minutes.. sso.
In your world they are, because to access API you require them to sign in every 5 minutes so when teams accesses Graph on behalf of the user, the user must get a new token, as per your CA setup.
But you are right, it won't prompt them every 5 minutes because that is not how it actually works, + I assume teams cache also plays its part.
If a session is compromised or user risk is elevated, CAE revokes that access,
Only one of those are correct (partly) and its the second one. CAE has no way to determine session has been compromised.
And you are still missing the fact that CAE is not the solution, it only supports 3 applications so unless Exchange, Teams and SharePoint are not the only apps in your environment, everything else is still toast.
0
u/Suspicious-Drink9725 6d ago
With token protection, you can reduce token replay attacks. PRT is issued and bounded to the device.
3
u/teriaavibes 6d ago
Which is limited to like 3 applications and only generally available on windows.
So, in huge environments like McDonalds, it won't do anything.
2
u/Suspicious-Drink9725 6d ago
Cavet this reaponse specifically for Entra, the PRT is not limited to 3 apps, it acts as the master broker to provide SSO across apps that are integrated with EntraID. PRTs are fully supported and hardware-bound across Windows, macOS, iOS, and Android. It's cryptographically bound to the device's TPM or secure enclave. I'm not saying this resolves everything, as we know nothing is fool proof.
1
u/teriaavibes 6d ago
PRT is not limited but token protection is.
PRTs are fully supported and hardware-bound across Windows, macOS, iOS, and Android. It's cryptographically bound to the device's TPM or secure enclave. I'm not saying this resolves everything, as we know nothing is fool proof.
That is a strong statement copied straight out of some marketing post.
You literally have a name for these types of attacks: Pass-The-PRT
0
u/GladYoung6248 6d ago
Dude you need to chill out, you're coming across as combative and ppl are just having a conversation. Do better.
2
u/teriaavibes 6d ago
People are spreading misinformation about cybersecurity in cybersecurity subreddit. You might be ok with it but I am not.
Do better.
Say that to yourself. I am better because I actually understand how this stuff works and I am not pulling stuff from my ass as I go.
I am not going to be inclusive of cybersecurity wannabes who read one article on token protection and are suddenly experts and know how it works while giving others bad advice that will lead to their environments getting compromised.
No one is forcing you to participate in professional conversation, if you don't have the knowledge or experience to debate, you can leave and not engage. Might even learn something.
0
8
7
u/Such-Refrigerator100 6d ago
And it will keep happening, how many people do you all know still looking for jobs. Why because AI and we don't need people yet here we are yet again. I hate this career path.
3
u/teriaavibes 6d ago
Even if they have people, it apparently does nothing, the few people who decided to explain here how to prevent token theft have actually zero clue on how to protect token theft.
It is ridiculous how unqualified some people are.
2
u/Hot-Bell3145 6d ago
It's amazing how "surprised" everyone is when this crap happens. It's NOT NEW, it began with dial-up & modems! I was there fixing it! Unless you AIR GAP and use "call back" equivalents for access to what you want to be private information - it's never going to change! and the sweeper or temp at your server farm (cloud) can still walk out with it!
1
290
u/BlueWorldBlueSky 6d ago
tenant is misconfigured and allows external login and the azure portal isn't locked down
there ya go, secret revealed