Exposure Of Information In MS Enterprise Enrollment, Entra, & Intune - Jeffrey Gaor & Parameswaran

Hello everyone. Thank you for coming here. Um I'm some of you may know me online as um offline is luxury or offline is new luxury. Um I lead the cyber security assessment at uh DA global and uh basically it's a uh boutique company that um a company is har security company that offers a uh um that offers solutions or services. is based out in Singapore and uh Switzerland. It um it's basically working with clients across Maya and uh beyond. So at Tech Global, our bread and butter is penetration testing and um GRC or governance and compliance. Basically um helping organizations um find and fix bugs before attackers or hackers do. So um you know making sure

governance and compliance are solid and um but we don't stop there. We also get um MSSP our managed service uh providers. It's basically for uh day-to-day protection. We also had uh integrations and implementation service make security reality fit into each um clients and environments and um we also cover academy where we train um people with practical skills in cyber security such as AI data protection so they are ready ready to handle uh real world challenge. Going back on the way, I published a few CBS back in 2003 2004. So some some of my oldies kind of work and I was fortunate to land a hall of fame um for companies like Apple, Oracle, Morgan Stanley and I also had

the chance to speak at Black Hat Arsenal that was last year 2004 2024 in Singapore and which was an incredible uh experience and today I'm really excited to be here at Bides to share you the uh new story with you. the you know talent data breach that uh that we discovered on our previous uh engagement or external pentest engagement. So moving on to the next slide. So our agenda is I'll start with in the uh the introductions to the Microsoft enterprise environment and then intra and then in turn this will gives everyone a baseline to uh you know understanding how these uh services fit into know you know fit together and why they often um come

enabled by default in in most organizations or company. Next, I'll walk you through the uh selling data breach. This is something as I mentioned we uncovered in our previous external pentest engagement and where we able to abuse a misconfigurations that um ultimately you know led to the exposure of sensed u informations or PII which means for personal identifiable um information. Then from there we'll look at how defra settings um can be abused where where I mean when a service account it got compromised. This is where I'll share a real example from our engagement that demonstrate basically that risk. Then after that we'll analyze the security implications and risk one of these misconfigurations of what hackers gain how defenders lose

visibility and why this qualifies as silent breach. Then lastly I'll wrap up the technical sections with the factors for mitigation and simple actionable steps you can implement to harden you know your environment and reduce the uh you know the exposure. So with that um let's jump right into the first section which is the the Microsoft enterprise enrollment. So for the Microsoft Entra Entra is basically the Microsoft identity access management umbrella or IM and it core is what uh used to known as Azure Active Directory now rebranded as Microsoft Entra ID. Right? So entra is what it handles basically the uh the authentications and authorizations for employees you know you know things like sing sign on sign in um multifactor

authentication conditional access rule based access you know to basically um manage the the uh the organization. So it's just as simple but the critical the criticality here is making sure that the only right people and device access to the company data. So it also ties directly to the office 365 Microsoft teams share point and even third party service. So now the reason you always see entra in the mix is because it is not optional every office 36 but rather it's um it's the central identity uh active directory without without it you cannot you know cannot manage or enforce security and it's basically the backbone of the micros cloud ecosystems. So next slide is the uh Microsoft

engine. Basically this engine is part of the uh the Microsoft soot and it's formerly known as um endpoint manager. It basically provides um mobile device management. And why does iTunes default engines default show up by default? Because in modern zero trust um you cannot just protect user identities right then um and you have to control endpoints as well. So in engine um it basically ensures that the only secure and compliant devices are allowed to access company and resources and that is why it's stored into the the intra or Microsoft intra and uh finally this is the uh Microsoft enterprise enrollment. This is basically part of the Microsoft enterprise agreement licenses. is basically um um formally known as Microsoft service at

at scales and the um and the reason why you see this uh enterprise enrollment by default is because your organizations is using Microsoft 365 enterprise and need that enrollment anchor that ties into your licensing billing tenant and while the policy is together. So B basically it is the contract backbone that keeps everything connected. So yeah so now what's this talk about? So as you know these days data reaches are are common and big risk for companies for every company sizes even for local low sizes company while as you can read on the news are often talks about aband hacking attacks or so for there's also um quieter but serious problem that sensitive informations getting exposed

because of simple or setup mistakes in in a common business systems or organizations. So what this talk looks at is basically a key weakness in the Microsoft enterprise enrollment entry ID in tune where default settings can accidentally import and user informations anyone noticing it. So let me jump into the next slide. So this is um by default access to admin center is let open. The reason is because historically service uh task rather like MFA registration password reset app consent security interfates were handled directly in portal that's why Microsoft keep this default check for backward compatibility so you know existing plans wouldn't wouldn't break but today there are a lot of dedicated self service portals that

handles these tasks like my my sign in for you know sign in activity and device management security info for managing MF methods my apps for uh enterprise SS access and I see the SSPR or self service password reset portal this means that you can you can actually safely restrict nonadmin access to the admin uh entry admin uh center while you know providing the service to the dedicated portals. So yeah, this is unchecked by default as mentioned and on the next slide I'll show you the attack uh sequence how we abuse this misconfigurations in our recent uh engagement. So let me walk you through the uh how this play out in our real engagement. The team and I were conducting um

blackbox external penetration test. Basically it we no insider insider knowledge just the company domain name and while we exploring we stumbled upon basically a subdomain hosting and insecure sites. So this kind of subdomain site um are often slipp through and are not as hardened as secure as the main uh website. Right? So on this site as you can see here we we actually found a uh zip file inside there were credentials and a lot of lot of them such as development accounts UAT accounts even some production ones but one entry really stood out is actually the service account that use for SMTP which is the protocol responsible for automating sending emails. Then what happens here is

here as you can see here most of the service account as everyone knows uh don't have MFA or multifactor authentication enabled because they are designed for automation and and um attended task. So to illustrate the risk, what we did here is we we log into the office uh.com using the service accounts and sure enough it worked without any additional verifications. Then on the next slide at first um when we thought that account might have useless because it's a service account right and it had no it had no uh mailbox access but right away I knew this was a serious discovery leak credentials on expo websites is basically technically a critical issue if you discover the

findings to client however bas based on experience in most cases. I also knew that if we reported this immediately to the client without deeper analysis or without showcasing impact um the clients were usually or the IT developers might you know you're usually brushed up saying things like it's just a development account no big deal trying basically trying to um downplay the the risk when I remembered um as you can see previous uh as you can see on This I seen before that in some Microsoft enter environment or even most company actually overlook this and enable uh by default. So that is some Microsoft enterment any authenticated user is basically can access the admin portal. You can even

try that if you have laptop at your end. So what I did here is I tested and um next slide. Sure enough, I was able to um log into their users. So in this slide, this is where the real impact became clear or this is when the risk become undeniable to the the IT or the developer. So using only the service SATP service account credentials we found on the exposed zip file previously we were able to sign into the Microsoft cloud and because service accounts typically um do not have MFA by design right log in succeeded without any extra challenges so here what I saw or what you can see here the Microsoft engine admin center on the right top you can

see there of 400 4,312 users found. So that's basically the entire corporate corporate directory exposed. That mean is I now have access to their corporate directory. Thousands of employees with full name, job titles, email, phone numbers, office locations and even actually their uh start date, employee start date. You can actually see there. So um and if you remember I don't use malware I didn't exploit any CVE I simply log in with a service account that had no MFA and because of the debulk entra settings or Microsoft entra settings I was able to enumerate every users in the organizations so from perspective it is actually uh gold it It's instant collecting informations or um it it's basically allows the attacker

to to gather informations or reconnaissance to collect map of the company's people and structures and you know the attackers can quietly pull down without racing a single alarm. So this is what I call a silent reach because everything over here looks like a normal and the activity but in reality the sensitive personal data has already w out the uh the door. So in the next slide so this basically this diagram summarize the entire attaching step by step. Now um it it started when I uh when we discovered a service account it's basically hidden in the exposed zip file since the accounts often service account often do not have MFA or multiffactor authentication um I was able to log in with just the

username and the password then from there I could access the entry admin portal even though it wasn't an admin account simply because it's um it's because it's in insecure by default settings. Now once I inside I directory enumerations pulling the at least thousands of users then um it brings me to the last stage which is the sound No exploits, no malware, no alarms. It's just a misconfiguration that um that allowed sensitive data to walk straight out the door. And on to the next slide. Now let's talk about the the security implication here. So the security implications here is basically um for a large organizations as an attacker it doesn't even need to to exploit further. So a full corporate

directory with names, emails and phone numbers can be packaged and you know sold out on the dark web. For criminals, this data is valuable because it enables fishing as a service. Credential staffing and you know for from a compliance perspective this is kind of exposure isn't just because embracing it could be classified as personal data breach under you know regulations like the GDPR or whatnot. So beyond fines there are the so-called reputitional damage customers, partners and employees expect theirs to be safe. So that is why silent reach the later show ups on black web dark web can erode you know the tress instantly and next slide. Then after that when I first submitted this talk to these side

leads if you know that one of the reviewer actually comment on uh that was on main and asked me uh a very questions actually if this issue been responsible or responsibly disclosed to the Microsoft. So the feedback actually stuck with me. So the very next day on May 10, I submitted the vulnerability to Microsoft through their MSRC program. It's basically a bag bounty program for security researcher and they actually acknowledge it and the bold ID as you can on the top. Then on May 23, Microsoft came back to me with their uh response that after investigation, it basically the the case didn't meet the u their uh bar for servicing it. Basically their bar for fixing it and the reason is

because the behavior is by design. In other words, these defaults as I mentioned earlier are are uh intentional at m the Microsoft stand. So for me this was just an important discovery because it's all it shows that we don't just demonstrate the risk but engage the vendor and even when a vendor says this is by design but that doesn't make you know the risk go away. So it's insecure by default. So this is actually the reply from from the Microsoft. This is by design provided with the reference link and um on the best practice side um up this two. So for the mitigation as I mentioned um or obviously these two uh restrict admin center access

since is by default it's best practice to enable this that only admin um should access the admin center and the other one is the creation by default is also unchecked. So the takeaway here is you know we don't wait for attackers to weaponize this insecure defaults lock down the admin center restrict tenants and uh another good best practice that we can implement here is the the uh Microsoft conditional access to you know protect service account it credential conditional access can actually um add extra layer of defense. For example, you can restrict access to the entra admin you know center by linking login to the the trusted IP range or geol location. So in practice conditional access doesn't stop

attackers at the password. It creates basically a multiple layer frictions by combining IPO location rules, app targeting and device compliance. And so to recap to wrap this up, basically a single low privilege account combined with secure default was um enough to expose thousands of users personal data. Again, no exploits, no malware, just defaults left or you know left unchecked. And the res dark web resell fishing maybe GDBR lines and lost trust. And the fix was simple. Restrict admin center access enforce conditional access with you know IP or geol location and restrict tenant creations as well. And the takeaway is one leak account plus insecure defaults equals a silent winch. So we don't wait to break it down before

someone else does. And um yeah, that's uh all my talk.

Any questions for

>> Microsoft? It took like 10 days actually. If I recall correctly, starting from May 10 and then the response May 23 or 30 days. Yeah. this question. >> Um they don't yet. I'm actually on coordinating with them um because of this cuz they actually slice and then they are uh check the check it for you know for for the quality or credibility of the presentation. actually appreciate the Microsoft for for that. But the thing there in my part is the misconfigurations is actually almost default for every company. So this I think it's main um a good talk to to show yeah for everyone's or companies or organizations awareness. Yeah. Thank you for that question. Wouldn't

your accident be picked up by the sock? >> Uh, that's a good question. Um, if you have to be picked up by the sock, it was actually not because in in most cases if the company doesn't have the SIM to monitor that lags, it won't be kept actually cuz the LS is just sitting there, but you you don't have third party like SIN or SIM to monitor the logs. you won't be alarmed basically. So to answer your question, they didn't get alarm because yeah, they don't yet. [Music] >> Take a question. >> How difficult was it to gain access to the service account itself? >> That's a good question because if you recall in my Let me go back to that one.

Do you have a sin page? And as you can see here, um, it was actually subdomain and most subdomain is actually not super hardened or super secure on the their main website. As you see the git ignore, it actually reveals the the file that which means that removing the git ignore and put the zip file there, it allows me to download the zip file and that zip file actually contains a plain text credentials which leads me to the SMTP service accounts and leads me to the this and this. Yeah. So not all that diffult. >> Yes, it's actually a chain box. Yeah. >> All chain abilities, misconceptions. Any questions? I'm happy to answer. >> Sorry.

service.

>> Basically, the service account can be abused as what I mentioned from from what I see during my uh during our external Pentest engagements. How we abuse that is basically just um like reaching that that service account from the website. we had the credentials and then when we tried to log into the office um office.com using the SMTP as as you recall managed to log in and then the implication or impact of that is that service account Microsoft usually don't have M it allow us to log in without uh you know any hassle or any uh blackers like the multifactor implications to to block us. So that question is actually just straightforward. No. Yeah. No blackers

that service can access to your admin portal. So that's that's answer the question. >> If you had found that service could you have used default service account from >> um actually a chain bug. So the answer is no. If I if it wasn't for the service account I discovered from your insecure website, I won't be able to access that. So that's a very good question. Yeah. Um any question please? No questions.

If you want me to connect I if you guys want to connect to link happy to accept your questions invite and again thank you so much for having me here and it's a pleasure to be present my my um talk it's actually the first time here and first time to present this talk so thank you everyone thank you so much for for your