1
00:00:04,580 --> 00:00:05,900
Hey, everybody.

2
00:00:05,900 --> 00:00:19,020
Welcome to watch the re-recording of my talk I gave at the DevCon CloudRidge for making the most of Microsoft Cloud Backbone programs.

3
00:00:19,020 --> 00:00:25,420
So, how I made 65k in bounties in 2021.

4
00:00:28,380 --> 00:00:29,300
So...

5
00:00:29,940 --> 00:00:31,520
My name is Dr.

6
00:00:31,520 --> 00:00:33,580
Nesteri Jylimaa, also known as Dr.

7
00:00:33,580 --> 00:00:34,660
Azure AD.

8
00:00:34,940 --> 00:00:45,620
And I think people know me best of my tool called AAD Internals, which I've been publishing since 2018.

9
00:00:46,100 --> 00:00:52,520
I'm a Senior Principal Executive Researcher at SecureWorks Counter Threat Unit.

10
00:00:53,120 --> 00:01:00,920
And what I do there is that I'm trying to find vulnerabilities for Microsoft Cloud before the bad guys do.

11
00:01:00,920 --> 00:01:02,620
So, that's pretty much what I do.

12
00:01:03,060 --> 00:01:07,240
I'm also a Microsoft MVP and one of the most valuable researchers.

13
00:01:07,240 --> 00:01:14,320
They actually announced last week or in the first day of Black Hat 2022.

14
00:01:15,420 --> 00:01:20,840
And actually, there I am on the list and I'm number 70.

15
00:01:20,840 --> 00:01:22,480
So, that's my 70th place.

16
00:01:23,960 --> 00:01:29,020
I've been working with MSRC now a couple of years, if you will.

17
00:01:29,320 --> 00:01:32,300
And it has been nice.

18
00:01:32,300 --> 00:01:42,600
So, for instance, they draw me a picture of me like that when they did like a research portfolio or research interview, if you will.

19
00:01:42,600 --> 00:01:45,840
It's actually still there on the MSRC site.

20
00:01:46,340 --> 00:01:50,820
And by the way, MSRC comes from the world's Microsecurity Response Center.

21
00:01:51,600 --> 00:01:59,600
And also, the people who are on that list are invited to a party.

22
00:02:00,840 --> 00:02:08,500
It's called MSRC Research Celebrity Party, where I was also last I think it was Wednesday.

23
00:02:09,000 --> 00:02:12,420
So, everybody who was on that list will get the invitation.

24
00:02:12,420 --> 00:02:14,760
So, it's actually quite nice to be there.

25
00:02:14,760 --> 00:02:18,720
And by the way, that is this time at least it's top 100.

26
00:02:18,720 --> 00:02:29,100
So, it was actually very nice to meet other people from the research community.

27
00:02:30,680 --> 00:02:33,860
And also, they are following me on Twitter.

28
00:02:33,860 --> 00:02:38,780
And it's nice to see, because they only have like...

29
00:02:38,780 --> 00:02:46,600
They are only following 75 people, including Satya Nadella, who is a CEO.

30
00:02:47,160 --> 00:02:49,380
Yeah, CEO of Microsoft.

31
00:02:49,380 --> 00:02:52,660
It's nice to be part of those.

32
00:02:53,680 --> 00:02:54,580
Okay.

33
00:02:54,780 --> 00:03:02,240
So, before we go forward about reporting bounties.

34
00:03:02,240 --> 00:03:05,280
So, people usually do that for three reasons.

35
00:03:05,280 --> 00:03:07,760
So, first one is obviously to get the bounty.

36
00:03:07,760 --> 00:03:11,140
Second one is to get points to be on that list.

37
00:03:11,620 --> 00:03:15,840
So, even though not all bounties will get...

38
00:03:15,840 --> 00:03:22,460
Sorry, even though there are vulnerabilities, not all are going to get bounty, but you are still having points.

39
00:03:22,920 --> 00:03:27,340
And the third is like me, that I just want to get things fixed.

40
00:03:27,340 --> 00:03:29,900
So, that's why I've been doing this.

41
00:03:30,620 --> 00:03:34,420
But hey, let's move forward.

42
00:03:34,420 --> 00:03:43,100
So, first of all, I wanted to share with you the site, where you can see all the bounty programs.

43
00:03:43,100 --> 00:03:51,760
So, you need to go to microsoft.com slash enus or whatever is your country and language slash msrc slash bounty.

44
00:03:51,760 --> 00:03:57,260
And here you actually have the list of programs.

45
00:03:57,260 --> 00:04:05,660
And I've been working with Azure program, Identity program and M365 program.

46
00:04:05,660 --> 00:04:12,480
And as you can see, the bounties, the highest bounty, at least now, is with Microsoft Identity.

47
00:04:12,840 --> 00:04:15,760
So, if you go here, you can see that...

48
00:04:17,560 --> 00:04:18,580
Scroll down.

49
00:04:18,580 --> 00:04:20,020
So, here's a nice table.

50
00:04:20,420 --> 00:04:29,300
So, if you can do the elevation of privilege and it's secure and it's high quality, you will get 100,000 bounty.

51
00:04:29,300 --> 00:04:31,020
That's a lot.

52
00:04:31,640 --> 00:04:38,880
So, my highest have been 20,000, like a single one.

53
00:04:38,880 --> 00:04:42,000
So, if I remember correctly, it came from this.

54
00:04:42,000 --> 00:04:50,120
But anyways, there are also like moderate or low severity vulnerabilities that won't get bounty, but you will get points.

55
00:04:50,120 --> 00:04:54,880
So, I suggest you to always submit if you have something, regardless of the bounty.

56
00:04:54,880 --> 00:04:56,000
So, please do that.

57
00:04:56,220 --> 00:04:59,400
So, you will get points and you will get on that list, actually.

58
00:04:59,540 --> 00:05:05,400
If you are doing a lot of those, even moderate or low findings, if you do a lot of those, you will be on that list.

59
00:05:06,360 --> 00:05:07,800
Okay.

60
00:05:07,820 --> 00:05:18,400
And if you look at the other programs, like N365, you can see that the bounties are a little bit lower.

61
00:05:18,400 --> 00:05:24,900
But anyways, these are very nice additions to your base library.

62
00:05:25,920 --> 00:05:27,400
Okay.

63
00:05:27,400 --> 00:05:31,280
But, where's my slides that there is?

64
00:05:31,280 --> 00:05:37,740
So, okay, there we go.

65
00:05:38,400 --> 00:05:44,660
So, I was planning, originally, like share three cases with you.

66
00:05:44,660 --> 00:05:54,080
But then, I decided to share two bonus findings also, because they are good stories.

67
00:05:54,080 --> 00:05:59,640
So, let's start with the first one.

68
00:05:59,640 --> 00:06:04,720
So, this is spoofing and tampering with Azure AD signing logs.

69
00:06:04,960 --> 00:06:09,400
So, very short walkthrough about the vulnerability.

70
00:06:09,520 --> 00:06:17,340
So, I think it was about a year ago, maybe a little over a year.

71
00:06:17,340 --> 00:06:22,700
But AD FS health agent got an update.

72
00:06:23,460 --> 00:06:26,880
And the AD FS health agent is running on the AD FS servers.

73
00:06:27,320 --> 00:06:37,920
And what it is, well, one of the things it is doing is that it will send all the signings, what are made to or through AD FS.

74
00:06:38,020 --> 00:06:42,940
They will send those to Azure AD, so that you can view them in Azure AD signing logs.

75
00:06:42,940 --> 00:06:47,740
Also, you can use like Sentinel to detect stuff, because they are there.

76
00:06:48,280 --> 00:06:57,060
So, when that agent was published, I kind of reverse engineered the protocols it is using to communicate to Azure AD.

77
00:06:57,060 --> 00:07:02,660
And I was able to, you know, spoof signing log events.

78
00:07:03,660 --> 00:07:08,600
But that was like by design, because that's how the protocol works.

79
00:07:08,600 --> 00:07:11,840
That's what the agent was made to do.

80
00:07:11,840 --> 00:07:15,020
So, there was nothing, you know, there.

81
00:07:15,140 --> 00:07:22,080
However, I noticed that one thing that was sent to Azure AD was a GUID.

82
00:07:22,080 --> 00:07:25,660
So, it was an ID of that signing event.

83
00:07:25,800 --> 00:07:35,720
And if I was using an existing ID that there already was in Azure AD signing log, I was able to override those signing events.

84
00:07:35,720 --> 00:07:42,640
So, basically, you could change the IP address and person who signed in at that time.

85
00:07:42,640 --> 00:07:52,160
So , for the bad guys, that was a good feature, because you were able to like cover your tracks.

86
00:07:52,740 --> 00:07:56,460
Anyways, I reported it and got the 10k bounty.

87
00:07:56,460 --> 00:08:05,760
And takeaway from this story is that the new features often, well, I would say always have business logic vulnerabilities.

88
00:08:05,760 --> 00:08:13,440
So, whenever Microsoft is publishing something new, it's a good chance for you to find things first.

89
00:08:13,440 --> 00:08:16,780
So, you just install that, study how it works.

90
00:08:16,780 --> 00:08:20,960
And quite often, there are business logic vulnerabilities like this.

91
00:08:20,960 --> 00:08:25,360
And it's kind of an easy way to get a great bounty.

92
00:08:27,640 --> 00:08:30,460
Okay, then the second one.

93
00:08:30,460 --> 00:08:32,780
So, Azure AD OSINT.

94
00:08:34,080 --> 00:08:41,520
So, there's a thing called Microsoft Support and Recovery Assistant or SARA.

95
00:08:41,520 --> 00:08:45,400
I'll just go away from the text for a minute.

96
00:08:45,460 --> 00:08:54,840
And that is a tool that is helped to analyze and fix problems if you have any problems to connect to Microsoft cloud services.

97
00:08:54,840 --> 00:09:00,140
Like, for instance, if you can't read your email, you just run the client and it will do some local analyzing.

98
00:09:00,140 --> 00:09:07,080
Also, it submits certain information using APIs to the backend.

99
00:09:07,280 --> 00:09:09,520
And then the backend is doing some checking.

100
00:09:09,520 --> 00:09:25,360
And I was able to find out that those APIs did not validate that the tenant ID or user ID I was sending there is the same than who was logged in.

101
00:09:25,360 --> 00:09:30,820
So, that allowed me to get information from other tenants.

102
00:09:30,820 --> 00:09:42,340
So, I was able to, for instance, get any user's email settings and licenses and so on.

103
00:09:42,500 --> 00:09:45,440
So, I reported that.

104
00:09:46,060 --> 00:09:52,500
And I originally found this from a legacy endpoint that hasn't been used for a while.

105
00:09:52,620 --> 00:09:57,480
But anyways, I got a 5k bounty from that.

106
00:09:57,480 --> 00:10:08,620
And they fixed that by disabling that cross-tenant access and actually pretty much the whole endpoint.

107
00:10:09,120 --> 00:10:15,980
But there was another endpoint that Zara is currently using and it still was providing the same information.

108
00:10:15,980 --> 00:10:18,980
Like, I was able to access information from other tenants.

109
00:10:18,980 --> 00:10:21,120
So, I reported that too.

110
00:10:21,120 --> 00:10:25,280
So, they finally fixed that.

111
00:10:25,280 --> 00:10:28,020
So, they disabled the cross-tenant access for good.

112
00:10:28,020 --> 00:10:30,140
So, that's not anymore possible.

113
00:10:30,520 --> 00:10:37,940
But I noticed that regular users, like normal users, can still get access from their own home tenant.

114
00:10:38,040 --> 00:10:40,840
And that access was not meant for their eyes.

115
00:10:40,840 --> 00:10:51,860
Like, for instance, they were able to see email trust relationships between your tenant and other tenants.

116
00:10:52,280 --> 00:10:59,280
So, that was like another kind of bug.

117
00:10:59,280 --> 00:11:00,860
But I still reported that.

118
00:11:01,040 --> 00:11:03,900
And again, I got a 5k bounty.

119
00:11:04,560 --> 00:11:09,300
So, but this time it was Elevation's privilege.

120
00:11:09,300 --> 00:11:18,780
So, basically, the takeaways for this is that if you have multiple findings which are similar.

121
00:11:19,000 --> 00:11:25,460
So, first send just one and not put everything in one post, just post one.

122
00:11:25,980 --> 00:11:29,680
And after the fix has been provided, then you can send another one.

123
00:11:29,680 --> 00:11:40,200
So, the logic here is that if you got a bounty for the first one, then you have to have a bounty also for the second one.

124
00:11:40,840 --> 00:11:44,260
And also, a tip that look for different categories.

125
00:11:44,260 --> 00:11:47,640
Like, the first one was information disclosure.

126
00:11:48,440 --> 00:11:52,580
So, even though that is fixed, there still might be something else.

127
00:11:52,580 --> 00:11:54,660
Like, in this case, privilege escalation.

128
00:11:54,660 --> 00:12:02,020
So, that was also quite nice way to report stuff like three in a row.

129
00:12:02,020 --> 00:12:04,580
So, I was able to triple the bounty for this.

130
00:12:06,500 --> 00:12:10,480
Okay, then the third one.

131
00:12:10,660 --> 00:12:13,860
And this is like my biggest bounty ever.

132
00:12:14,640 --> 00:12:19,560
So, originally this was by design.

133
00:12:19,560 --> 00:12:27,900
Anyways, and then finally it ended up like to two 20,000 bounties.

134
00:12:28,020 --> 00:12:31,820
But let's focus on what is this all about.

135
00:12:31,820 --> 00:12:35,920
Okay, so this is related to Azure AD Connect.

136
00:12:36,220 --> 00:12:39,240
And that is a service that is...

137
00:12:40,200 --> 00:12:44,880
Sorry, it is synchronizing stuff from your on-prem AD to Azure AD.

138
00:12:44,880 --> 00:12:46,780
And that's the purpose of it.

139
00:12:48,400 --> 00:12:50,940
And nothing like a special there.

140
00:12:50,960 --> 00:12:56,640
Anyways, I was able to, again, like reverse engineer the API it is using.

141
00:12:56,640 --> 00:12:58,920
So, it's actually proprietary API.

142
00:12:58,920 --> 00:13:02,660
So, it's not public API and it's using binary XML.

143
00:13:05,400 --> 00:13:10,140
And the purpose of Azure AD Connect, as I said, was to synchronize users.

144
00:13:10,140 --> 00:13:15,180
And it is allowed to edit those users which it has synchronized.

145
00:13:15,180 --> 00:13:17,440
It is allowed to delete those users.

146
00:13:17,440 --> 00:13:22,980
It is allowed to reset passwords and so on.

147
00:13:24,660 --> 00:13:28,440
So, anyways, I found out that there are two IDs.

148
00:13:28,440 --> 00:13:33,800
So, there's a source anchor and then there's a cloud anchor.

149
00:13:33,800 --> 00:13:42,440
The source anchor is users on-prem AD ID and the cloud anchor is users Azure AD ID.

150
00:13:43,660 --> 00:13:48,400
And cloud only users doesn't have that source anchor at all.

151
00:13:48,400 --> 00:13:55,720
But I was able to find out that you can also use the cloud anchor to edit users.

152
00:13:55,720 --> 00:13:58,400
So, I said that, okay, this is the cloud anchor.

153
00:13:58,400 --> 00:14:01,020
I want to edit, I want to delete it and so on.

154
00:14:01,020 --> 00:14:02,840
Or I want to reset the password.

155
00:14:02,840 --> 00:14:08,080
And that shouldn't be allowed.

156
00:14:08,840 --> 00:14:19,100
But anyways, I was able to, you know, like take over global admins even from the cloud because I was able to reset their passwords and even delete them.

157
00:14:19,100 --> 00:14:25,620
And then maybe do some extortion or ransom to the target organizations.

158
00:14:25,620 --> 00:14:27,780
Okay, I deleted all your admins.

159
00:14:27,780 --> 00:14:29,980
Give me money and you will get them back.

160
00:14:29,980 --> 00:14:34,400
So, that was the finding that I was able to do.

161
00:14:34,400 --> 00:14:35,320
Okay.

162
00:14:35,420 --> 00:14:43,980
So, I reported that and that was categorized by design.

163
00:14:44,180 --> 00:14:53,000
And I had a very many like replays and contacts with MSRC.

164
00:14:53,000 --> 00:14:59,600
And actually, there was a kind of a director from Microsoft I knew.

165
00:14:59,600 --> 00:15:04,660
And I sent him an email that, could you have a look at this?

166
00:15:04,660 --> 00:15:12,260
Because it really feels that if you're an on-prem admin, you shouldn't be able to delete stuff from cloud.

167
00:15:12,580 --> 00:15:16,060
So, finally, they decided that, okay, yes, that is a real issue.

168
00:15:16,060 --> 00:15:20,700
And they provided me a 20k bounty.

169
00:15:23,100 --> 00:15:25,260
And they fixed that.

170
00:15:25,380 --> 00:15:32,720
So, I saw a tweet of one of the product managers who tweeted that, okay, they have now fixed that.

171
00:15:33,360 --> 00:15:38,180
And I noticed that, okay, actually, you can...

172
00:15:38,180 --> 00:15:43,580
So, the fix was that there's a setting that Global Admin can turn on.

173
00:15:43,580 --> 00:15:50,640
It's something like a disable cloud only takeover or something like that.

174
00:15:50,640 --> 00:15:52,860
And you set that to true and that's it.

175
00:15:54,280 --> 00:15:58,280
And then I noticed that how they fixed that.

176
00:15:58,280 --> 00:16:03,120
So, it was actually part of the settings that the Azure AD connect user.

177
00:16:03,120 --> 00:16:06,320
So, if you compromise that server, you will get the credentials.

178
00:16:06,540 --> 00:16:09,460
And those credentials can be used to change that setting.

179
00:16:09,460 --> 00:16:14,500
So, basically, you would just change that back to the original setting.

180
00:16:14,500 --> 00:16:16,240
So , that was, again, possible.

181
00:16:16,420 --> 00:16:19,280
So, I told him that and he said, oh, that's bad.

182
00:16:20,860 --> 00:16:24,580
And he said that they are going to reopen my previous case.

183
00:16:24,580 --> 00:16:28,100
So , kind of like they will get back to that.

184
00:16:28,260 --> 00:16:30,380
But I was like, no, no, you don't.

185
00:16:30,380 --> 00:16:32,460
So, I submitted a new one.

186
00:16:32,460 --> 00:16:39,420
You report on bypassing that fix and I get another 20k bounty.

187
00:16:39,420 --> 00:16:40,560
And now it's fixed.

188
00:16:40,560 --> 00:16:42,880
So , it's really fixed now.

189
00:16:42,880 --> 00:16:46,600
So , that you need to be global admin to be able to change that setting.

190
00:16:47,340 --> 00:16:48,900
Okay, the second ways.

191
00:16:48,900 --> 00:16:54,780
So, when they are providing a fix, you should study that like very carefully.

192
00:16:54,780 --> 00:17:01,400
And look that if there's anything like you could go back and bypass that.

193
00:17:01,400 --> 00:17:05,240
And then look for things that exist independently.

194
00:17:05,240 --> 00:17:10,200
Like the flaw on changing these settings have been there for years.

195
00:17:10,460 --> 00:17:14,700
And I knew that you can change those settings as that user.

196
00:17:15,240 --> 00:17:17,600
But there just wasn't any use case for that.

197
00:17:17,600 --> 00:17:18,840
But now there was.

198
00:17:19,560 --> 00:17:25,280
So, when this case was open, they fixed that stuff.

199
00:17:25,280 --> 00:17:29,320
I was able to compromise that that has been there already for years.

200
00:17:29,320 --> 00:17:34,300
And also, do not accept any reopening old cases.

201
00:17:34,300 --> 00:17:37,300
Because the old case was actually fixed.

202
00:17:37,300 --> 00:17:39,660
So , the status was fixed.

203
00:17:39,660 --> 00:17:40,760
The fix just didn't work.

204
00:17:40,760 --> 00:17:42,340
So, it's a different case.

205
00:17:42,460 --> 00:17:48,340
So, don't accept that and just post a new report and you should be good to go.

206
00:17:50,560 --> 00:17:54,780
Okay, then the first bonus case.

207
00:17:54,780 --> 00:17:56,880
So, this was actually not found by me.

208
00:17:56,880 --> 00:18:00,460
But this was found by an Indian guy called Ravanakaram.

209
00:18:00,480 --> 00:18:02,280
No write-up yet, please.

210
00:18:02,840 --> 00:18:06,440
And a very short walkthrough.

211
00:18:06,540 --> 00:18:10,880
So, Access Packages or Azure Access Packages are like...

212
00:18:11,760 --> 00:18:15,780
It's a service where you can apply access to certain services.

213
00:18:15,780 --> 00:18:20,140
Like, for instance, I want to have access to that Teams site or that SharePoint site.

214
00:18:20,140 --> 00:18:22,800
I want to access email and so on.

215
00:18:22,800 --> 00:18:29,860
And this is meant for people inside the organization, but also external contractors.

216
00:18:30,740 --> 00:18:40,500
So, by design, of course, it will show those access packages that are meant for outsiders where you can actually apply to have those.

217
00:18:40,500 --> 00:18:51,720
And we found out that the backend API actually allows external users to view all the packages.

218
00:18:51,740 --> 00:19:00,740
And also metadata, including the people's names or actually email addresses who created those access packages.

219
00:19:00,880 --> 00:19:02,800
So, we reported that.

220
00:19:03,680 --> 00:19:07,740
Well, actually, his original report was quite large.

221
00:19:07,740 --> 00:19:12,720
And he had some problems with MSRC, and he was tweeting about that.

222
00:19:12,720 --> 00:19:20,620
And I told him that, OK, based on what you show, I don't know if there really is anything.

223
00:19:20,760 --> 00:19:25,480
But if you can DM me, we can work this out together.

224
00:19:26,460 --> 00:19:30,380
And we actually ended up submitting three different reports.

225
00:19:30,380 --> 00:19:31,760
So, this is one of them.

226
00:19:31,760 --> 00:19:42,080
And, yeah, so MSRC found out or they concluded that, yes, there is a vulnerability, but it's moderate.

227
00:19:42,080 --> 00:19:44,740
So, it's not severe enough.

228
00:19:45,500 --> 00:19:50,880
So, let me show you the bounty program.

229
00:19:50,880 --> 00:19:53,660
And I think this was from Azure.

230
00:19:53,860 --> 00:19:55,260
Sorry about that.

231
00:19:55,680 --> 00:19:57,420
Let's see.

232
00:19:59,540 --> 00:20:05,980
So, yes, so it was information disclosure, but it was moderate.

233
00:20:06,000 --> 00:20:07,740
So, there was nothing.

234
00:20:11,340 --> 00:20:16,640
And we weren't that happy about that, because we think that that was quite severe.

235
00:20:16,640 --> 00:20:21,460
And actually, I looked at the documentation of that access packages.

236
00:20:21,880 --> 00:20:30,640
And I found out that only people who can actually create those packages are either global administrators or user administrators.

237
00:20:30,680 --> 00:20:34,860
And this is actually literally what I told them that, according to documentation, it's like this.

238
00:20:34,860 --> 00:20:36,840
So, it looks quite severe to me.

239
00:20:36,840 --> 00:20:43,360
And they reassessed that and they raised the severity to important.

240
00:20:43,360 --> 00:20:48,060
And he got actually that seven and a half thousand bounty.

241
00:20:48,060 --> 00:20:51,640
So, I didn't take any of that bounty.

242
00:20:51,640 --> 00:20:53,000
So , it was his.

243
00:20:53,000 --> 00:20:57,900
So, I just helped him to, you know, argue with MSRC.

244
00:20:58,040 --> 00:21:05,120
So, takeaways from this is that argue using your documentation.

245
00:21:05,120 --> 00:21:10,120
So, if the documentation they have says something, then use that.

246
00:21:11,120 --> 00:21:13,080
And EA, it was quite really easy.

247
00:21:13,080 --> 00:21:17,420
So , they were like giving out global admin names, and that is a bad thing.

248
00:21:17,420 --> 00:21:22,720
Of course, if they would have been like normal users, that might have been like it's not that severe.

249
00:21:22,720 --> 00:21:24,140
But in this case, it was.

250
00:21:24,720 --> 00:21:32,640
Also, remember that reporting moderate or low vulnerabilities still gives you a point to get on that list and to that great part.

251
00:21:32,640 --> 00:21:35,200
So, yeah, always report.

252
00:21:37,180 --> 00:21:42,960
Okay, then the second bonus.

253
00:21:42,960 --> 00:21:44,640
Or was this the last one?

254
00:21:46,860 --> 00:21:50,080
Yeah, this is the last one, yes.

255
00:21:51,220 --> 00:21:53,140
Yeah, the second bonus, yes.

256
00:21:53,140 --> 00:21:56,980
So, this is Azure AD Ocean Part 2.

257
00:21:57,140 --> 00:22:00,460
Okay, and this is one of the findings.

258
00:22:00,460 --> 00:22:06,900
Well, it is that Microsoft has business partners.

259
00:22:06,900 --> 00:22:15,580
And those partners have a thing called partner center where they can manage their customers.

260
00:22:15,920 --> 00:22:22,880
And, you know, perform like administrative tasks to their customers' tenants.

261
00:22:22,960 --> 00:22:28,580
But there was also a tool to find other partners.

262
00:22:28,580 --> 00:22:34,860
And I was able to call that API also directly.

263
00:22:34,860 --> 00:22:46,720
And I noticed that you can get not just information about the partner, but any organization.

264
00:22:46,720 --> 00:22:56,640
So , if I just gave a tenant ID of any tenant to that API, it pulled out information from that organization.

265
00:22:57,680 --> 00:23:08,100
So, if you will just log into your own tenant, you are able to get this organization information from any other tenant, regardless are they partners or not.

266
00:23:08,700 --> 00:23:17,880
And that information includes the, well, the full name and phone number of the person who created that tenant.

267
00:23:17,880 --> 00:23:19,760
And that usually is a global admin.

268
00:23:20,680 --> 00:23:26,100
And I reported that and they categorized that again as by design.

269
00:23:26,100 --> 00:23:30,420
So, this information is public anyway, so it's a good feeling.

270
00:23:30,980 --> 00:23:32,020
And that's it.

271
00:23:32,020 --> 00:23:33,900
So, nothing argued there.

272
00:23:35,100 --> 00:23:39,240
But then something interesting happened when we published this.

273
00:23:40,000 --> 00:23:41,720
Or disclosed this, the whole thing.

274
00:23:41,720 --> 00:23:46,800
So, we are writing threat analysis and report like these kind of findings.

275
00:23:46,800 --> 00:23:54,260
And like a week after we disclosed this, Microsoft fixed the issue.

276
00:23:54,740 --> 00:24:06,700
And I don't know why, so maybe someone else like outside MSRC saw this and assessed that this is actually something that you shouldn't be able to do.

277
00:24:06,880 --> 00:24:10,280
So, they reassessed my report.

278
00:24:10,640 --> 00:24:15,160
And they found out that yes, this is actually information disclosure.

279
00:24:15,160 --> 00:24:19,160
And it's worth of $2,000.

280
00:24:20,280 --> 00:24:24,260
And let us go back here.

281
00:24:24,260 --> 00:24:34,100
So, I go back a bit and go to here because this API was at microsoftoffice.com.

282
00:24:35,060 --> 00:24:44,100
And here I noticed that, okay, information disclosure, $2,000 for medium report.

283
00:24:44,100 --> 00:24:46,460
And I was like, what the heck is this?

284
00:24:46,460 --> 00:24:48,860
So, you are not happy with my work anymore?

285
00:24:48,860 --> 00:24:49,960
Okay, I didn't like that.

286
00:24:49,960 --> 00:24:51,940
So, I asked them, why?

287
00:24:52,920 --> 00:24:56,620
Can you say the reasons why this is like a medium quality?

288
00:24:56,620 --> 00:24:58,820
And it took over two months.

289
00:24:58,820 --> 00:25:04,540
So, they were back and forth between the MSRC and the bounty program and then even the engineering.

290
00:25:04,540 --> 00:25:09,020
So , they were saying that we didn't decide that and so on and so on.

291
00:25:09,020 --> 00:25:14,300
And finally, I was able to get an answer.

292
00:25:14,300 --> 00:25:21,200
And the answer was that, okay, we actually reassessed this and the quality was actually high.

293
00:25:21,200 --> 00:25:27,240
So, they decided to give me an extra $3,000 bounty.

294
00:25:28,240 --> 00:25:30,880
However, they haven't not paid that yet.

295
00:25:31,140 --> 00:25:34,260
So, still waiting for that.

296
00:25:34,260 --> 00:25:39,020
Okay, and the takeaways from here.

297
00:25:39,100 --> 00:25:43,980
So, if you feel that the assessment is not correct, ask for reasons for that.

298
00:25:44,000 --> 00:25:48,720
So , you don't need to be mean to Microsoft.

299
00:25:48,720 --> 00:25:49,580
Don't be.

300
00:25:49,720 --> 00:25:50,960
You just want to know why.

301
00:25:50,960 --> 00:26:01,440
Because, for instance me, I wanted to know that what was wrong with the report, so that the next reports I will create would be like a higher quality.

302
00:26:01,440 --> 00:26:03,480
But there was nothing wrong, actually.

303
00:26:03,480 --> 00:26:10,780
So , I don't know why they ended up in this assessment that it was mean.

304
00:26:10,780 --> 00:26:13,100
But, well, you never know.

305
00:26:14,720 --> 00:26:17,620
After my talk, I had a couple of questions.

306
00:26:17,620 --> 00:26:33,920
And one of the questions was, if I remember correctly, that because I've been working with MSRC now a long time, they know me and I have a good service, if you will.

307
00:26:34,220 --> 00:26:35,860
So, what about newbies?

308
00:26:35,860 --> 00:26:43,220
So , yeah, when I started reporting stuff, I didn't get that good, let's say, service.

309
00:26:43,820 --> 00:26:53,400
And there are not that many people there who are triaging these kind of reports related to identity or hazard, for instance.

310
00:26:53,400 --> 00:27:03,180
And it's also important to understand that, for instance, this identity stuff that I'm researching, it's quite a niche area.

311
00:27:03,300 --> 00:27:07,600
And there might be five people in the world who knows about that stuff, and you are one.

312
00:27:07,600 --> 00:27:10,320
So, there's only four left.

313
00:27:10,640 --> 00:27:15,020
And usually, they are not the one who are triaging your report.

314
00:27:15,280 --> 00:27:22,980
So, it's important that you create a good POC, or POC, as in proof of concept.

315
00:27:22,980 --> 00:27:26,000
So, it's easy for them to try.

316
00:27:26,000 --> 00:27:30,660
I usually, well, because I'm doing that AAD internals toolkit.

317
00:27:30,660 --> 00:27:32,880
So, that's written in PowerShell.

318
00:27:32,880 --> 00:27:51,640
So, I'm quite often using PowerShell script as a POC, so that they can just simply run the script, and they can, like, rerun the error or vulnerability, whatever I have on.

319
00:27:52,920 --> 00:27:57,600
And I think there was other questions too, but can't remember those.

320
00:27:58,020 --> 00:28:01,420
So , yeah, I think that's it.

321
00:28:01,420 --> 00:28:03,760
So, hope you enjoyed this.

322
00:28:03,760 --> 00:28:08,780
And if you have any questions, just contact me on Twitter, and I'm happy to help you.

323
00:28:08,780 --> 00:28:09,600
Okay.