Hackers could abuse legitimate Windows AD FS to steal data
The flaw in Microsoft authentication servers could enable threat actors to perform a Golden SAML attack
Security researchers have warned that hackers could easily abuse a Windows service to steal data from any organization using Active Directory in their network.
According to FireEye, the new attack could give hackers another way to take over Microsoft 365 accounts via a flaw in Active Directory Federated Services (AD FS). The attack echoes the recent SolarWinds attack.
AD FS is a feature for Windows Servers that enables federated identity and access management. Organizations often use it to provide single sign-on functionality to access enterprise applications such as Microsoft 365.
Hackers could spoof one AD FS server communicating to another AD FS to obtain its keys. The attack is not dissimilar to a Golden SAML attack that CyberArk coined in 2017. In that type of attack, hackers can access any application supporting SAML authentication with any privileges and be any user on the targeted application.
In the new attack, hackers could abuse the Policy Store Transfer Service to acquire the encrypted Token Signing Certificate over the network.
With previous techniques, hackers needed to execute remote code on an AD FS server to extract the data or at least an SMB connection to transfer the backing database files. The new attack requires only access to the AD FS server over the standard HTTP port. The default AD FS installation will create a Windows Firewall rule to allow HTTP traffic from any system.
“Additionally, a threat actor does not need the credentials for the AD FS service account and can instead use any account that is a local administrator on an AD FS server. Lastly, there is no Event Log message that is recorded when a replication event occurs on an AD FS server. Altogether, this makes the technique both much easier to execute and much harder to detect,” said Doug Bienstock, IR Manager at FireEye.
Get the ITPro. daily newsletter
Receive our latest news, industry updates, featured resources and more. Sign up today to receive our FREE report on AI cyber crime & security - newly updated for 2024.
Bienstock said the authorization policy itself also presents an opportunity for abuse. Because the authorization policy is stored as XML text in the configuration database, a threat actor with enough access could modify it to be more permissive.
“A threat actor could modify the Authorization Policy to include a group SID such as domain users, S-1-5-21-X-513. Similarly, they could add an ACE to the DKM key container in Active Directory. This would allow the threat actor to easily obtain the Token Signing Certificate and decrypt it using any domain user credentials. This would give them persistent ability to perform a Golden SAML attack with only access to the network as a requirement,” Bienstock said.
While the attack has not yet been observed in the wild, writing a proof of concept would be trivial, according to Bienstock.
Researchers said the best mitigation against this technique is to use the Windows Firewall to restrict access to port 80 TCP to only the AD FS servers in the farm.
“If an organization has only a single AD FS server, then port 80 TCP can be blocked completely. This block can be put in place because all traffic to and from AD FS servers and proxies for user authentication is over port 443 TCP,” said Bienstock.
Rene Millman is a freelance writer and broadcaster who covers cybersecurity, AI, IoT, and the cloud. He also works as a contributing analyst at GigaOm and has previously worked as an analyst for Gartner covering the infrastructure market. He has made numerous television appearances to give his views and expertise on technology trends and companies that affect and shape our lives. You can follow Rene Millman on Twitter.
Want developers to build secure software? You need to ditch these two programming languages
Sundar Pichai says more than 25% of Google's code is now generated by AI – and it's a big hint at the future of software development
HPE ProLiant MicroServer Gen11 review: A smart little server for small spaces