This is the second post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. In Part 1, we covered how attackers steal tokens in the first place. This post digs into Continuous Access Evaluation, the event-driven mechanism Entra ID adopted to help close that gap.
Continue reading Continue readingNiklas Kerner
Token Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques
This is the first post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. Over the next four posts, we’ll walk through how token-based attacks work, put important Microsoft defenses gaining relevance in this context, Continuous Access Evaluation and Token Protection, through empirical testing, and check where Entra ID still deviates from OAuth 2.0 best practices. This post sets the stage: why token theft matters, and how attackers actually get their hands on a token.
Continue reading Continue readingERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls
While most attacks against cloud identities still rely on traditional password-based techniques, such as password spraying, credential stuffing, and brute-force attacks, these methods have become less effective as multi-factor authentication (MFA) has become more widespread. As a result, attackers are increasingly turning to token-based techniques, including token theft, adversary-in-the-middle (AiTM) attacks, device code phishing, and ConsentFix, which get around MFA instead of trying to break it.
As one of the most widely deployed identity platforms, Microsoft Entra ID is a prime target for these evolving attack techniques. This raises the question: how well does its defense-in-depth strategy actually hold up against this shift? We put it to the test.
Continue reading Continue reading