I Took Over a Microsoft Cloud Account. Again.
Source: YouTube · John Hammond · published Nov 15, 2023 · 25:42
This video demonstrates how to compromise a Microsoft 365 account using a device code phishing attack, allowing an attacker to hijack a user's session without needing their password directly 0:00.
Key Takeaways:
• The technique utilizes "device code authentication," similar to logging into streaming services on a smart TV, where a user is tricked into entering a code on a legitimate Microsoft login page to authenticate a device controlled by the attacker 0:44.
• The attacker uses the PowerShell tool "TokenTactics" to generate the device code and capture the resulting access and refresh JSON Web Tokens (JWT) once the victim logs in 9:43.
• To enhance credibility, the phishing email is sent via the Azure Cloud Shell, appearing to come from an official Microsoft address, and instructs the victim to enter the code at microsoft.com/devicelogin 10:40.
• After the victim authenticates, the attacker converts the stolen tokens into HTTP cookies using a custom script, granting direct browser access to the victim's Outlook inbox and data 20:47.
The presenter notes that while this demo highlights the ease of access, organizations should implement conditional access policies and monitor for anomalous login behaviors to mitigate such threats 23:25.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
we are going to take over a Microsoft 365 account and that'll give us so much access to all the things in that whole Cloud ecosystem right we can read their email we can look at their calendar we can set up meetings or send message across Microsoft teams now we have already set the stage for us to be able to demo this hacker technique in a previous video we created a developer tenant for us to be able to explore an experiment with this Microsoft 365 stuff and even in another video we stole a Microsoft 365 session token using evil Jinx with a fishing email and a social engineering scheme so that we could gain access as that user in this video we're going to do something similar to break into the cloud environment but we're going to use a different tactic called device code authentication or…