Summary: Also known as “nOAuth”, the Azure AD Authentication bypass attack works across sites where organizations have enabled the “Login with Microsoft” feature within their environment. When implemented correctly, this authentication method allows users easy access to cloud-based services, however, when incorrectly applied, this method can make it easy for adversaries to compromise user accounts and access sensitive company information or resources. A successful attack gives a bad actor full run of a victim’s accounts, with the ability to establish persistence, exfiltrate data, explore if lateral movement is possible, etc.

In the Azure AD environment, OAuth is used to help manage user access to external resources, such as Microsoft 365, the Azure portal, and thousands of other SaaS (software as a service) applications using OAuth apps. Anyone with malicious intent and a decent amount of platform knowledge can simply set up an Azure AD account, and arbitrarily change the email attribute under “Contact Information” in that account to control the email authentication claim. “[This] allows the attacker to use ‘Log in with Microsoft’ with the email address of any victim they want to impersonate,” the researchers explained.

Why it matters: The attack flow is extremely simple and was just recently patched by Microsoft, with documentation dated June 20, 2023. It is imperative to all businesses that use “Login with Microsoft” to follow their latest security recommendations and patch any affected Azure AD applications to minimize the risk and ensure that multifactor authentication cannot be bypassed while logging in. Researchers have stated: “If your app uses ‘Log in with Microsoft’ and you handle authentication in-house, it’s critical that you check if you use the email claim returned by Azure AD as the unique identifier. If so, remediation steps should be taken to ensure the claim used as the unique identifier for the user is the ‘sub’ (Subject) claim to avoid potential exploitation.”

Summary: The recent growth of Artificial Intelligence (AI) has had an effect on many different industries and fields. Cybersecurity is no exception. In the famous letter by tech industry leaders earlier this year called for the pause of AI development due to its unknown risks. Even CEOs of AI companies including OpenAI’s Sam Altman and DeepMind’s Demis Hassabis acknowledge the societal risks AIs pose. For Cybersecurity in particular, AI can be used to help correlate and adapt to new attack patterns. At the same time, attackers can use AI to help create and improve existing attack methods such as fraud and phishing.

AI is one of the fastest growing fields recognized today. The release of ChatGPT-3 and the subsequent release of ChatGPT-4 has worried industry leaders about the potential uses of AI. Some of the uses can be seen in AI created malware that can bypass traditional security tools. These new tools in particular can help inexperienced malware developers create more advanced malware through the use of generative AI. This growth not only increases the complexity and effectiveness of malware but also increases the number of possible threat actors by loosening the barrier of entry into malware development.

Why it matters: AI is a dual-use technology that can be used by both legitimate and threat actors. On one hand, AI and Machine Learning can help improve software and their capabilities to detect malicious software. From the side of the defenders, AI’s self-teaching capabilities allows it to quickly adapt to the changing threat landscape with very little help. On the other hand, threat actors can use AI to create more sophisticated viruses and convincing social engineering attacks. While those are the more common uses of AI for both offense and defense, AI has already opened new avenues of attack that not necessarily lies in the traditional software-based world of security but the potential of real-life harm using AI-generated images, videos, and audio. These new threats posed by AI can target companies and people affecting them personally, financially, and possibly even legally. Although it is easy to assume that the usage of AI can easily be done ethically, there is still a possibility of misuse that could potentially undermine the user’s intent. Not only does regulation help protect society from unknown risks posed by AIs, it also would help shape the standard of current and future AI usage. It is thus important to not only be aware of how to use AI but also how AI can be used as a threat.