start	end	text
0	7820	Alright, so let's move ahead with our next talk and before we go ahead, some little requests.
7820	12060	One is to keep your phones on silent because that would end up disturbing the speaker.
12120	17580	Apart from that, if we end the discussion, if the discussion ends and if there are some
17580	21960	questions that you'd like to ask, the speaker would be available in the speaker's lounge
21960	26080	next door. So you can reach out to him over there and continue with asking your questions
26080	27900	if the time ends over here.
28160	34800	Alright, so up next we have the very famous Dr. Nestori Sinema and he is, I mean, so we
34800	38880	all know him, he's a very famous person and he's a Senior Principal Information Security
38880	45620	Researcher at SecureWorks CTU. Previously, Dr. Sinema worked as a CIO, consultant, trainer
45620	51840	and a university lecturer for over 20 years. And yes, he speaks in regular conferences,
51840	57260	he's been Microsoft's most valuable security researcher. He also holds multiple Microsoft
57260	62880	certifications and yep, he has spoken in a lot of conferences with respect to Microsoft
62880	67920	365 and Azure AD Security. So please welcome Dr. Nestori Sinema.
73670	80550	Thank you, for kind words. Let's try to make them work. Okay, so...
82450	86930	Does it work? Of course it doesn't. That's nice.
86950	93330	Now we know. Okay, so well, you already introduced me, so thanks about that. So again, my name is
93330	98090	Dr. Nestori Sinema and I come from Finland, but everything else you said is true, so we can move
98090	103010	forward. By the way, follow me on Twitter or X or whatever it's called nowadays. And
103010	110390	Mastodon and Blue Sky, so I'm everywhere. With the same title, Dr. Azure AD. And most of you,
110390	118450	know me best of my two AD internals. Who has used that? Okay, if you haven't, you should,
118450	124630	because APT29 uses that too. Also known as Nobilium. Well, at least they have used the same
124630	130070	techniques according to my attack framework. Okay, what else? Yes, so...
132550	139890	I was in summer holiday with my wife in Spain and in July 11th, Microsoft decided to change
139890	145430	the name of the product, so it's not anymore Azure AD, now it's Android AD. And that's very great
145430	152410	for a guy whose handle is Dr. Azure AD. And the tool name is AAD internals. But that's not the
152410	157630	first, sorry, first part, because I actually ordered a new car before we went to the holidays
157630	164930	and it was then delivered after that. And I chose a vanity place to that. And of course, that's AAD.
165870	166230	So...
171760	177360	So every time Microsoft is doing rebranding, it costs me 1000 euros, so it's pretty much the same as dollars.
179180	181500	Okay, so I have some slides and demos.
184660	189680	And I asked, do you want to have recorded or live demos? And most of you wanted to have
189680	193720	recorded, so recorded it's going to be. Well, I have one live demo at the end, but
193720	196520	otherwise all the demos are recorded.
198120	204140	And let's start with some background information. So how many of you know what is Azure AD
204140	211100	or Android AD? Okay, but short introduction, just for the background information. So it's
211100	216880	Microsoft cloud-based identity and access management. Closer? Oh, okay.
218540	226920	Better? Okay. So let's try to get this to work. Okay. And it's used by, of course, Microsoft's
226920	232740	own products like 365 and thousands of third-party applications, so there's a lot of them.
232820	237300	And it has multiple authentication options, so that's important for attackers. We will get back
237300	243040	to it later. And usually all the stuff that is in there is synchronized from on-prem environment
243040	248900	or on-prem AD, so that's how it's usually done. And that is done using Azure AD Connect
249460	253020	or Cloud Sync, so there are two different things to do that.
255400	262780	Yes, so about... well, the information I'm going to share with you today, I used that actually
263360	269620	last year to gather some data about how many of people are using Azure AD actually.
269620	274600	And I think Nick's geek had a presentation earlier... well, it was yesterday, and so he
274600	280440	had some background information, but I have also. So let's start with Fortune 500 organizations. So
281240	288840	about 80 months ago, 88% was using Azure AD, which is a quite big number. But in
289520	297760	Finland, where I come from, the percentage is 98. So it's a lot more. And then top universities
297760	305480	roughly 95% is using. And this next one is funny. So in Finland, we have like 302 municipalities,
305480	315320	like cities and towns, and there's one who doesn't use. So it's almost 100%. But if you round up,
315320	321380	it's 100%. So it's fair to say that everybody in Finland is using, and globally also like 90%. So
322740	327220	that is very interesting to attackers. So there's a lot of organizations who are using,
327220	332780	but you still need to know what to attack. So not just that they are using, but are there
332780	340280	something that you can actually attack? So well, this is... everybody knows this. So at least some
340280	345960	kind of version about cyber killshame. So we are in the recon village, so we are in the first wave.
345960	351480	So we want to gather information so that we can start the weaponization, then the actual attack.
351480	358840	But we are not doing anything bad at this point. Well, oh, nothing bad. So we are not attacking,
358840	363440	but of course, we are gathering intelligent information. So that is kind of also bad.
364380	371540	But luckily, there's a lot of stuff available like for free, and even without any authentication.
372060	377460	Okay, so I told you that there are multiple authentication options. And usually you have
377460	385160	connected your on-prem to cloud. And here are four, at least currently, available authentication
385160	390880	options. So I'm not going to deep dive into the details, but still, I'm going to introduce each
390880	397660	of those. So the version on the left is called Identity Federation, or ADFS is the, well,
397660	404720	the product or Windows feature you use to implement that. So have any of you heard about
404720	411780	golden time attacks? Yes, so this is the one. You can do that. Okay. And this was the first
412340	417800	available option that allows you to use the same credentials in on-prem and cloud.
418500	425300	Okay, but it's very like a big environment. So you need to have at least four servers to run that.
425300	430160	And that's not a very good option for small businesses, for instance. So then Microsoft
430160	435680	introduced the password hash synchronization. So basically we have a component, this Azure AD Connect,
435680	440760	and it's synchronizing both users and other objects, but also password hashes, but not the
440760	447540	NT hashes. Well, technically yes, but they are re-hashed a thousand times, so that's okay.
448320	453120	And then there's a new stuff introduced a couple of years ago called password authentication,
453120	458920	which means that you install a small agent on your on-prem environment. And then when people
458920	463100	are trying to authenticate, those credentials are sent to that agent, and then it tries to
464540	470940	log in using your Windows domain, and if that's okay, the user gets in. And the last one is
470940	477980	certificate-based authentication. And also there's a funny thing called seamless single sign-on,
477980	483540	which is Kerberos-based single sign-on, which all the deficiencies that the Kerberos has.
483540	489320	So basically, if you are able to steal a certain NT hash from your on-prem AD,
489320	493880	you can log in as any user you want to cloud, if they are using that.
494080	500040	So there's five different ways, at least, how you can attack the authentication stuff.
501200	507240	And why this is important? Well, I have a couple of slides here. So first one is for ADFS. So there
507240	512640	are actually eight different ways, at least, how you can obtain the token signing certificate and
512640	519800	perform calls and attacks. So this is very complicated, and you can just get one of those
519800	524900	paths and you are good to go. So if you want to protect against those, that's not that easy,
524900	533020	and it's good for attackers, right? And the second one is for PTA. And the PTA is a very interesting
534140	540400	product, because if you are able to compromise the server that is running that PTA agent,
540400	547540	you can export the certificate, and after that you have a persistent undetectable way to perform
547540	554600	denial-of-service attacks, and also use that as a backdoor. And that's quite neat. So if they are
554600	560320	using that, it would be nice to know. Well, unfortunately, at least now we can't know if
560320	566120	they are using PTA. Other methods, yes, but not the PTA. But this is just to show you that these
566120	570720	things are very complicated, and when they're complicated, they are always vulnerable somehow.
572020	576500	Okay, then about hybrid cloud security, a couple of words. So
576500	582100	people have asked me for years, is cloud safe? And I would say that yes, it is.
583400	589400	At least until recently when they stole that token signing certificate, but usually it's okay.
590100	594800	So if you want to, as a user, access the cloud, you need to have like
595400	601400	some proof of identity, and that's it. So it's easy to use. But it's not good for bad guys,
601400	606160	because they don't have the proof of identity. So they have two options. So they can either
607060	612540	get the proof of identity, like using phishing, and then they are able to log in, or they can
612540	619600	spoof the identity. And how can they do that? Well, if you have connected your on-prem environment
619600	626120	to cloud, you're actually drilling holes to that safe cloud. And now the attackers can attack
626120	631380	using the old methods they already know to those on-prem components, and via them they can go
631380	635820	and attack your cloud. So this is what happened with Solarigate, actually.
638900	646360	Okay, and then some goals to our recon. So what we want to do, we want to enumerate
646360	651700	authentication options, so that we know where to attack. We want to find valid accounts and
651700	657920	domains, so that we might do some social engineering, for instance. And of course,
657920	662860	we could do phishing much easier if we know the valid accounts. And we don't want to leave any
662860	671300	traces, meaning that we don't want a target organization to detect us, obviously. That
671300	681760	would be otherwise quite a stupid recon. Okay, so then how to get OSINT, or open source intelligence?
682040	688140	So we have two options. So we have anonymous API calls, and this is for everybody. So everyone
688140	696040	can use these APIs to get that information. And then another way is to use authenticated APIs
696800	701540	calls, and that requires that you need to have an Azure AD tenant. It doesn't have to be the
701540	707340	target tenant. You can just sign up for a trial, and that's it. You just need to have one,
707340	711380	which means that you need to log into your own tenant, so that you can get information
711380	717900	from other tenants. So this is how Azure AD is done, or built.
720260	726120	Okay, so what can you get using these anonymous API calls? So first of all, you will get
727100	734020	all registered domains that the target tenant has. You may find out that is that domain
734020	740380	managed or federated, and if it's federated, it's open for code on some attacks.
740380	746700	That's always good to know. And by the way, you only need one domain being federated, so that you
746700	752820	can do those attacks. And of course, you can have DNS information, so are there any mail exchange
752820	757840	records, or SPF records, and so on. So you know that is that organization routing mail through
757840	765280	Microsoft 365. You can have tenant ID with domain name. You can find out does the user exist.
765820	772280	So if you have a username, you can try that. Is that real username? And then you can see that
772280	777440	is the tenant using, or is the tenant ever used, a thing called Azure AD Connect Cloud Sync,
777440	786440	which is a new kind of tool instead of Azure AD Connect. So this Cloud Sync is a new version
786440	793060	that Microsoft would like us to use, but usually we don't. And then we also can find out that
793060	800620	is the tenant using Microsoft Defender for identity? So we will more likely get caught
800620	808800	if they are using. So it's good to know beforehand. Okay, so domain names. So how can we get those?
808800	816120	So technically, this is using Exchange Online Auto Discover Service, which is used usually for
816120	821440	for that, that if your user have your Outlook client, and they type in their username,
822300	827480	then the Outlook can go to the Auto Discover Service to get information that where that Outlook
827480	835860	should connect. However, if you want to, you can make a federation between two Exchange
835860	841780	organizations. And a federation means that if your organization A and organization B, you can allow
841780	848020	them to see other calendars, for instance. So that's the federation. And for that purpose, the
848020	854180	Auto Discover is also used that you can ask that, okay, here's a domain name, what other domains
854180	861580	there are. And I actually talked today with one of the Microsoft guys, he might be. So he asked me
861580	866500	that, is it really true that you can get this information from Azure AD? Because the documentation
866500	872240	said that you need to be at least a guest to get that information. And I said, no, that's not
872240	881760	true. So basically, there's an API endpoint, you send there a SOAP request that has a domain,
881760	887640	and as a return, you will get a list of all the other domains that tenant has. And it's very good
887640	893280	for recon, because there might be some new product name, for instance, or there might be some mergers
893280	899080	coming up. So they have just registered domains there and so on. So yeah, and also we can see that
899080	905340	the Exchange version is 2015, which is quite old. I don't know, is it really that old, but at least
905340	913640	it says so. So that was the first one. And then there's different APIs you can call to get
913640	918440	information about the domains itself. So what's the domain type, is it managed or federated,
918440	924860	or does the user exist? So there's different endpoints to do that. And then you can also
924860	930760	see that this technical name, desktop SSO, the sailing name is seamless single sign-on, is that
930760	939360	enabled? So that was the Kerberos stuff. So if you can get that, if he has a certain service account,
939360	944320	you can then log in as any user to the cloud, if they are using this. And then you can also see
944320	949740	that is the certificate-based authentication enabled? So a lot of information, and these
949740	957660	are all like open APIs. And then, I don't know, did you see Nick's talk yesterday?
957660	966740	But he actually found a nice way to enumerate users using OneDrives. So usually if you have a
966740	973600	user who has a license for Teams, for instance, that user also will have a OneDrive.
973600	980020	And basically what you do is that if your organization is like, let's say, Microsoft,
980020	984360	and the username is like user at microsoft.com, you need to normalize that, which means that you
984360	992380	just replace at and dots with an underscore. And then you make HTTP head request to that URL.
992880	1000280	And if that returns 200 or something like that, the user exists. And if it's 400, it doesn't exist.
1000280	1006380	So quite a neat way. And this is good because there's no login events anywhere. So a target
1006380	1013700	organization can detect this. Only Microsoft can, but not the target organization.
1013700	1020580	And these are also not throttled. These other APIs are. So after 100,000 something, you will
1020580	1030680	get false positives that it exists, even though it doesn't. Okay. Tenant ID, just call that API,
1030680	1037560	call, sorry, that URL with a domain name, and you will get back in a JSON file where the
1037560	1043680	tenant ID exists. So you can parse it, for instance, from here. So quite easy, neat way to do that.
1046180	1052160	And then the Azure AD Connect Cloud Sync. So how do we know if the organization is using that?
1052160	1056940	Well, they decided to make their username standard. I mean, the admin, sorry, the service account
1056940	1063180	name is standard. It's always the same. AD2AD Sync service account at domain name. And if that
1063180	1069560	user exists, you know that they are using that. So quite easy way, again, to find out internal
1069560	1077320	information of the organization. And the last one is the Defender for Identity. So if these DNS
1077320	1083180	names exist, then you know that they are using that. So again, quite easy way. So just ping that
1083180	1090880	if it answers or just do other NS lookup, and if you can find that, you know that they are using
1090880	1098800	Microsoft Defender for Identity. Okay. And here are all the commands you can use with my
1098800	1107160	AD internal toolkit. So I'm going to show demos for this. So four commands, and each are doing
1107160	1113080	one bit, and then the last one is going to do all the stuff. So let's start with the first one.
1113340	1118300	So we want to get login information to a certain domain. We just give a domain name, and it is
1118300	1125060	calling three or four different APIs, and then just put them all together. So we can see that
1125060	1130620	what we can see. We can see that account type is federated, for instance. So Microsoft.com is
1130620	1140540	federated. And then let's move forward to the next one. So we're going to get the tenant ID,
1140540	1146380	but this is quite simple. You just give a domain name, and it will return you the tenant ID.
1146940	1152440	And tenant ID you will need to use in certain API calls if you are doing some hacking, if you
1152440	1159320	get inside the organization. So it's a very valuable information. And the next one, we're
1159320	1165280	going to list all the domains of the organization. And this is actually quite fast. So it's
1166640	1170020	second or something, and it will list all the domains. For instance, Microsoft has
1171020	1179660	about 280 or something domains. Like tune.net. Does anybody remember that? Yeah.
1181580	1188300	Okay. And the last one is the actual like kill chain functionality I've included in my tool.
1188880	1195320	So it provides some domain name, and it will do all the stuff. So it will gather all the
1195320	1201800	information it can, especially from the domains. So the last part is FT means format table.
1201880	1208540	But this takes a lot, so I, you know, cut away something. And here we can see a lot of new
1208540	1221470	information. And let's just scroll back up. Yes. So here we have like what is tenant brand,
1221470	1228810	tenant name, tenant ID, tenant region. That's Bird Wild. Yes. And it doesn't use desktop SSO
1228810	1234010	and the Cloud Sync they are using. So that's a good information. And then if you want to do some
1234010	1241690	phishing stuff, it's good to know that is it using this particular like domain for
1241690	1247430	for Mail Exchange? Is it sending it from the Cloud? So if there's SPF record, it means that
1247430	1253730	it is sending outside also. And DMARC is, well, it also says that it is using that for sending email.
1254090	1258190	But all that kind of information you can get. And also the STS means that what is the Federation
1258190	1269830	server name that that particular domain is using. OK. And then we have the authenticated API calls,
1269830	1275490	which means that you need to have your own tenant where you can log in and then gather stuff of
1275490	1281470	other other tenants. And what you can get is the you can get the tenant name or domain from
1281470	1286370	tenant ID. And where do you use this? Well, actually, this is more like for admins. So
1286370	1291850	if you have you can see that some people are logging in using some weird application.
1292090	1296790	You can't see who created that, but you can see the tenant ID who created that application. So
1296790	1303390	you can do like a reverse lookup for that. And then if you have the user's email, you will get
1303390	1309650	the user's object ID in Azure AD using that email. You can have a user's display name and also
1309650	1316350	user's UPN or user principal name. But this is also neat. You can see team status of that user.
1316370	1326090	If the user is using Teams. And here are the commands again, which I have in AAD internals.
1326090	1332850	So you can get the domain, you can find the Teams user, and then you can see if that user is
1332850	1342980	available. So let's start. So first, we need to get an access token because we need to be
1342980	1348520	authenticated. And this is for our own tenant. So I'm just going to get one for Microsoft Graph,
1348520	1355600	which you can use to get that tenant ID, sorry, tenant domain using tenant ID. So you need to
1355600	1363000	have that. And you need to be actually global admin in your own tenant. I don't know why,
1363000	1367180	but you need to be global admin, but because it's your own tenant, you can be. And now you can get
1367180	1376640	ask information about other tenants. The next one is, what was it? Access token for Teams.
1377020	1387780	Because Teams has quite interesting APIs, and one of them is that you can search external user.
1388400	1394020	And when you give the user principal name of the target user, it will get a lot of nice information.
1396940	1403280	Well, for obvious reasons, I'm not showing those to you, but it shows what is the user's tenant ID,
1403280	1408840	what is the user's user principal name, what is the display name, and then what is the object ID.
1409840	1416460	Now, I don't know why that information is revealed, but it is there. And one thing that you can do
1417140	1423740	with the object ID is that you can see that is that user online in Teams. So let's see how that goes.
1429640	1434040	So you can provide either user principal name or the object ID, and then it will tell you is this
1434040	1442520	user online or not. And actually, in Nick Skeak's talk, he had a nice graph that he used this API
1442520	1449880	to get information that were Microsoft employees working or not. And they had an all-hands meeting
1449880	1456660	on Friday at a certain time, because they were all offline. And now we can see that this particular
1456660	1462360	person is offline. And this is... I don't know why this information is available. Well, because,
1462360	1474060	well, information must be free and so on. Okay. But yes. So basically, that was all I got for
1474060	1481740	those internals commands. But for those who don't want to type PowerShell, I made a tool,
1481740	1489820	online tool. It's from aadinternals.com. And it can tell you the same thing that I showed to you.
1489820	1492340	And I'm going to demonstrate that, by the way, next.
1494700	1507140	So here we are. And we go to aadinternals.com. And let's zoom a bit.
1508820	1514860	So here you can give a tenant ID. You can give domain name or email address of a user.
1515300	1524200	Let's try this. So we can see that it's the CIO of Microsoft doing something.
1528620	1534780	Okay. So we can see what's the logo of that organization. We have tenant branding, tenant ID
1534780	1540560	worldwide. They are not using single sign-on, but they are using the Azure Cloud Connect sync.
1540600	1545860	No certificate-based authentication, at least for this user. And they have that much verified domains.
1548160	1553260	I might mistype this, actually. I always do that. Let's try again.
1559860	1564480	So yes. Now we can see that he's away. So there's no calling to him.
1566220	1570440	And actually, if you think about this team status, that's a very good recon information,
1570440	1576560	because you can actually follow somebody. What is he doing? So is he available? Is he not?
1576700	1580540	And then you can, like, well, you know what you can do with that information.
1580680	1585160	And you know where people are. And also, like, we have links to...
1587220	1592620	So we can click here. Let's see how this works. So it wants me to sign in.
1592620	1600140	And let's see, does this work? No, it didn't. So, but usually there's AD FS service. They are
1600880	1603560	asking that, where do you want to log in? So you can actually see
1604760	1609300	other organizations. This organization has business relationships. And that's also
1609300	1615640	more information for you to start, like, searching for more or gathering more intelligence.
1618120	1622740	Okay. But yes, that was all. Thank you.