Interpreting "Risky Users" in Microsoft Entra admin center

[Markverhyden]

In one of the FB tech groups I'm in, IT BOG, I see frequent posts from frustrated IT guys of yet another client of theirs that got poached via this approach.

How would you characterize the customer base, ie consumer, 1-5, 6-10, 10-50, etc, of those participants? My point is stealing tokens is not a trivial operation. Black hats aren't going to engage in that exercise for consumers and very small businesses. The pay day just isn't there. Situations like that they'll just keep up with the $399 your security has expired or MS support scams or the numerous others that are easily automated for the script kiddies. Now doing that for an organization that is utilizing many services available through M365/Azure is a totally different matter.

 

[Sky-Knight]

How would you characterize the customer base, ie consumer, 1-5, 6-10, 10-50, etc, of those participants? My point is stealing tokens is not a trivial operation. Black hats aren't going to engage in that exercise for consumers and very small businesses. The pay day just isn't there. Situations like that they'll just keep up with the $399 your security has expired or MS support scams or the numerous others that are easily automated for the script kiddies. Now doing that for an organization that is utilizing many services available through M365/Azure is a totally different matter.

Sir, stealing the token IS a trivial operation. That's the point that is being missed here. If you can get the user to click on the wrong thing, you can get them into a proxy and have that proxy lift the token. If you can get the user to click on the wrong thing, you can get them to execute malware, and that malware while it's setting up a crypto bomb can also exfiltrate all the cookies from the browsers in the system for use against the cloud surface.

AND, this entire process is fully automated.

https://www.google.com/search?client=firefox-b-1-d&q=smbs+are+facing+the+same+threats+as+enterprise

The tide has turned, SMB is screwed. ChatGPT integrated malware is real, and it's growing. A year after the fact, we're talking about why I closed my MSP. Saw this day coming, I'm REALLY dreading the usual upswing of malware that hits Black Friday. It's not going to be pretty.

 

[YeOldeStonecat]

How would you characterize the customer base, ie consumer, 1-5, 6-10, 10-50, etc, of those participants? My point is stealing tokens is not a trivial operation. Black hats aren't going to engage in that exercise for consumers and very small businesses. The pay day just isn't there. Situations like that they'll just keep up with the $399 your security has expired or MS support scams or the numerous others that are easily automated for the script kiddies. Now doing that for an organization that is utilizing many services available through M365/Azure is a totally different matter.

My friend has had 2x different law firms breached via token theft....small offices, <10 users
I forget what his 3rd one was, I think dentist office.

As for "other chatter" that I read in the IT BOG Facebook group....I see lots of posts from people that I will call "Gods of 365, big time people in the larger MSP space". As well as some that specialize in higher end security. They're not taking it lightly, and they run across it frequently.

The toolkits to perform these hacks are dirt cheap, and widely available on the black market.
Various toolkits that inject the proxy address, as well as scrape cookies from system memory, pulling cookies out of browsers, pulling tokens out of memory or HDD.

Been a couple of years since these token thefts first came out, and it's an easy peasy kit to purchase now and put into use. The newer versions are spread via PDFs and other "common attachments"...they get opened, and put on your computer and they go and do their work.

 

[britechguy]

Black hats aren't going to engage in that exercise for consumers and very small businesses. The pay day just isn't there.

^ This. This a thousand times over.

Without a payoff, a real payoff, why bother? This stuff isn't done "for pure amusement."

 

[YeOldeStonecat]

"The pay isn't there".

Well, this pissing contest is getting a bit...well, head in the sand? I don't know what to tell you.
Rats, RaaS (ransomware as a service), PaaS (phishing as a service)...these kits are all available on various underground resources ...as a huge business.
This article by bleeping computer is over 1 year old so the prices are higher...because the prices have gotten dirt cheap.

New EvilProxy service lets all hackers use advanced phishing tactics

A reverse-proxy Phishing-as-a-Service (PaaS) platform called EvilProxy has emerged, promising to steal authentication tokens to bypass multi-factor authentication (MFA) on Apple, Google, Facebook, Microsoft, Twitter, GitHub, GoDaddy, and even PyPI.

www.bleepingcomputer.com

Or purchase the kit...for under 50 bucks according to this site..

Dangerous Cyberattack Kits Cost Less Than $50 on the Dark Web

With cyberattack kits being so readily available on the dark web and the prices so low, anyone who dares step into the dark net can acquire the tools needed to launch a cyberattack.

www.missioncriticalmagazine.com

Look up "EvilProxy"...which is one of the more popular kits specifically for this token theft mechanism.

Another more recent article...prices ranging from 200 up...

Cybercriminals Using EvilProxy Phishing Kit to Target Senior Executives in U.S. Firms

A new phishing campaign is on the rise, targeting U.S. organizations. Cybercriminals use EvilProxy to hijack accounts.

thehackernews.com

The "payday" is there. I have a friend who is a small law firm, focusing on real estate. He had his paralegals account breached two different times and they watched for a while and redirected the "deposit" for a closing at the last second (a very popular goal for phishers who love to target real estate brokers and law firms that focus on real estate closings). My wife has been in Real Estate for decades and I know a lot of broker offices in my area and law firms that specialize in real estate...and I'm not exaggerating when I say it's been a common phishing goal towards them.

I am far from crying wolf here folks. I barely consider myself "middle ground" when it comes to 365...and I'm quite in a mild panic over this....it's a real concern, it does happen at a frequent pace now. My "trenches" and "colleague grapevine" that I play in every day are fairly large to get a realistic sample from.

 

[YeOldeStonecat]

EvilProxy uses indeed.com open redirect for Microsoft 365 phishing

A recently uncovered phishing campaign is targeting Microsoft 365 accounts of key executives in U.S.-based organizations by abusing open redirects from the Indeed employment website for job listings.

www.bleepingcomputer.com

 

[britechguy]

@YeOldeStonecat

That last article, in particular, supports the point that this is targeted, very carefully targeted, activity, which is what I (and another) have been saying all along.

The claim from my side is not now nor has ever been, "this never happens." The claim is, and remains, this is carefully, strategically targeted activity where "the average Joe/Jane" is not the typical target and expending tons of concern as though they were is unwarranted.

The juice has gotta be worth the squeeze. Targeted phishing campaigns are nothing new; they're also targeted, not scattershot, and it's reasonably easy to determine whether one is in "the target demographic" for the most part.

This isn't a danger "lurking around every corner" for the vast majority of computer users. That matters.

 

[YeOldeStonecat]

That last article also had this....quote/unquote
"
In August 2023, Proofpoint warned of another EvilProxy campaign, which distributed approximately 120,000 phishing emails to hundreds of organizations, targeting their employees’ Microsoft 365 accounts.

Unfortunately, the use of reverse proxy kits for phishing is growing and combining them with open redirects increases the success of a campaign...

Researchers at Menlo Security, report that the targets of this phishing campaign are executives and high-ranking employees from various industries, including electronic manufacturing, banking and finance, real estate, insurance, and property management."

That first sentence is only what Proofpoint filtered....and Proofpoint noticed through their system. They're not the biggest filtering system out there (or poop-point as I call them...we used to resell it, I hated it).

I have clients that are in those categories...and more.

Just yesterday in the IT BOG FB group another MSP posted about some of their clients getting poached by this approach. He came asking for help. Some of us believed him and engaged in a conversation, with some "big guns in the 365/MSP world" thankfully joining the conversation....as they believed him, they took him seriously. It's evolving into a good post with many helpful replies, which is often a good outcome of IT-centric social media groups.

 

[britechguy]

@YeOldeStonecat

You have been incredibly, incredibly helpful to me, and I don't want this to get acrimonious.

I have no doubt that what you have reported is true. I also see that you work in what amounts to a "very high dollar" area of the country within the sphere of influence of NYC. It is unsurprising that you are seeing targeted phishing campaigns at smaller, yet very high dollar, enterprises. And that's because they are "juicy targets."

We simply are not going to agree about the prevalence of the practice that's concerning you so in the world at large. I have seen no convincing evidence, including the references you've cited, that lead me to believe that this is anything other than very targeted. It's not scattershot. It's not likely to happen to me or my clients (including the business ones) because they are, in the grand scheme of things, just too small in the "potatoes scale."

I go back to my oft-repeated position: I focus on what I consider to be reasonably possible, in context, not remotely possible, but highly unlikely.

If this practice every becomes truly widespread, then "the next infosec expert" is going to have to come up with the next layer of armor (which will eventually be pierced) to protect the general public at large. We're just nowhere near "there" yet, and that's because targets are carefully chosen for value. It's spear phishing.

 

[Markverhyden]

"The pay isn't there".

Well, this pissing contest is getting a bit...well, head in the sand? I don't know what to tell you.

You're missing the point. A "product" has to have a market to generate revenue. That even applies to illegal activities. Yes, as I mentioned earlier, <insert product/service>aaS has also grown in the black hat world. I wonder how many black hat providers operate in a contingency agreement. Probably none. They're going to want money up front, and the minimum is probably not trivial, and even more once pay day arrives.

Consumers and very small businesses generally don't have setups that attract "investing" in WhateveraaS to collect session creds. Because they don't use all the benefits that come from SSO. Sure they'll maybe have Exchange and Onedrive/Sharepoint. That's it. All of my customers fall in that environment. There's a lot of other stuff under that umbrella that large groups use which have monetary value. Like encrypting a database. To date we've had following breach's or attempted breach's

1 (This one was a whopper). Customer's bank allowed, with out a peep of notice to the customer, a foreign entity to issue a P2P payment request against their business account to the tune of nearly $80k. They have never used P2P before and the next highest payment was around $18k via check. It was only caught because the office help regularly logs in every week to reconcile checks. Even after escalating this to the "VP" in charge of their account, even more incredibly the bank allowed another P2P payment request from the same foreign entity for $8k which was also caught shortly after.

2. Someone intercepted a check the company had written to cover a bill, around $400, altered the check to $40k and deposited it in an account in another bank in another state.

3. Lots of MS Scam webpage popups that a few customers kept falling for.

4. Handful of attempted redirects of payroll via the "my regular bank is down for maintenance so send to ...." emails.

Almost guaranteed stolen creds were not involved in any of those.

I'm not saying that that stolen creds aren't happening. The perps are just targeting certain types of companies. It's far easier to dox a larger company to get a large mail list to target.

And let's not loose sight PEBCAK is always in play. I've haven't had any recent calls from 3 above after politely loosing my temper with the handful of trouble makers responsible

 

[YeOldeStonecat]

You're missing the point. A "product" has to have a market to generate revenue. That even applies to illegal activities. Yes, as I mentioned earlier, <insert product/service>aaS has also grown in the black hat world. I wonder how many black hat providers operate in a contingency agreement. Probably none. They're going to want money up front, and the minimum is probably not trivial, and even more once pay day arrives.

Not missing the point at_all. Far from my first day on the job. I know many criminals like these operate as a business...how much $ will this investment generate. These kits aren't in the thousands anymore. There's in the hundreds...low hundreds, and even under a hundred. And you don't have to be a code writer to use them, they're sold as easy peasy kits to use, made for non computer savvy crooks to use.

Payback doesn't take much. It's not so much that there's value in finding files in OD/SP. Some of these people can be smart...they know how to operate in stealth, and wait for the right moment. Case in point...and...(I know it won't be believed, but it's quite common)....those that bust into the email accounts of Realtors, brokers, law firms that deal with real estate...especially the paralegal in those offices. Those are usually small offices...the law firms, say a paralegal or two, and one or two attorneys. The one I know personally..that had it happen a few times til he left his prior IT guy to come over to me, was just him, his paralegal, and one other office girl. Very small office, a little hole in the wall. Not a "big juicy target". He got hit at least 2x times. His paralegal had her account popped...they watched. They watch the email coming in and out. There will be a trend noticed over time, certain broker offices the firm works closely with, certain banks they work with...there's generally small circle involved with every closing...buyers side, and their lender, the sellers side, and their bank. The crooks watch....and for example, see a closing is scheduled for 1pm today. They see the crossflow of email between all parties...noting the email address of all involved, type of language used, etc. Often, not too long before closing, they'll use the paralegals email account that they poached and have been watching everything with, to send an email out to the buyers side to redirect the deposit to a different bank. The closing appointment time comes...the buyers side walks into the room "Oh yeah, I got your email..don't worry we did redirect that deposit of $65,000". Sellers side goes bug eyed "What? What email?!"

Since my wife is a Realtor...for quite a while...and quite a successful one in her career....I have talked to lots of other Realtors and brokers (as she's worked at a few different ones...since many offices try to steal her from others)...and have talked with the smaller law firms she becomes friends with for the closings. In my little corner of sleepy south east Connecticut (not a big city). And we have what I'll call a "fairly decent sample size of clients"...near 200x 365 tenants...each of those varying sizes of clients...many little offices of 2-3, a decent amount of medium offices of a dozen or a few dozen, and a small handful of larger businesses towards 100. So in our own little world...under our own umbrella...we run across situations where a staffs account got poached. I'm not making that up. I see it with my own eyes, I'm not dreaming, not crying world. It's not like we manage the IT for the Whitehouse or the Pentagon or Lockheed Martin. We manage the IT for typical every day mundane businesses....staffed with every day mundane people. Save for yeah, 2x particular clients I forget if I mentioned above, one is a branch of the Coast Guard located at the Academy, the other is a larger manufacturing business located in both CT and FL...does some pre fab and repair work for a big name in the aerospace industry.

Several months ago we lost a client...a fairly large client (around 60-70 staff)...was great monthly money..on an MSP plan, and located 2/3 of a mile right down the road from us. The company sold, a new "boss" came in...and he was a pain. Our relationship strained (not my client but one of our other engineers clients). The boss had his 365 account poached. We had him on MFA. But he let the bad guy in. The check that his finance lady stroked and sent was $85,000 (based on the email sent to her from his account)...and he tried to sue us to get that back, blaming us for his account getting poached. We were getting tired of that client anyways...but it sucked to lose that...3500 or near 4k/month.

Just 3 or 4 weeks ago, the CEO of a client of mine that is a small "foundation" (only about 8 staff)...had her email poached. They have had MFA enforced by conditional access. Some ...what I'll call..."test" emails from the intruder were sent to board members. She noticed them...and called me. She was smart. But it did happen...I'm not making it up.

Anyways, we're clearly all just dug into our trenches here...not budging. I'll still probably start a thread or add to the other 365 InTune thread I have on better "locking down" a 365 tenant...so a couple of people here might find it helpful can check it out.

 

[britechguy]

I'll still probably start a thread or add to the other 365 InTune thread I have on better "locking down" a 365 tenant...so a couple of people here might find it helpful can check it out.

An excellent idea. This topic has "gone opinion" quite a while back. No point in letting useful, factual information get lost here.

Steps for tightening down and/or locking down an M365 tenant are not really subject to argumentation. Their value might be, but the "how to" is not going to vary, or at least not at the level of individual settings configuration.