This is the second post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. In Part 1, we covered how attackers steal tokens in the first place. This post digs into Continuous Access Evaluation, the event-driven mechanism Entra ID adopted to help close that gap.
Continue reading Continue readingMisc
Token Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques
This is the first post in a 4-part blog series that accompanies ERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls. Over the next four posts, we’ll walk through how token-based attacks work, put important Microsoft defenses gaining relevance in this context, Continuous Access Evaluation and Token Protection, through empirical testing, and check where Entra ID still deviates from OAuth 2.0 best practices. This post sets the stage: why token theft matters, and how attackers actually get their hands on a token.
Continue reading Continue readingERNW White Paper 80: Token Theft in Microsoft Entra ID - An Analysis of Controls
While most attacks against cloud identities still rely on traditional password-based techniques, such as password spraying, credential stuffing, and brute-force attacks, these methods have become less effective as multi-factor authentication (MFA) has become more widespread. As a result, attackers are increasingly turning to token-based techniques, including token theft, adversary-in-the-middle (AiTM) attacks, device code phishing, and ConsentFix, which get around MFA instead of trying to break it.
As one of the most widely deployed identity platforms, Microsoft Entra ID is a prime target for these evolving attack techniques. This raises the question: how well does its defense-in-depth strategy actually hold up against this shift? We put it to the test.
Continue reading Continue readingERNW White Paper 79: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection
With this blog post I am pleased to announce the publication of a new ERNW White Paper about our incident analysis and digital forensics framework. It is available on our website.
Due to the increasing number and impact of computer security incidents, it has become essential to develop and implement efficient measures for their investigation. However, comprehensive forensic analyses are time-consuming, and this time is often not available to security analysts during computer security incidents. As a result, automated tools are increasingly being used. These tools, however, often cover only a limited scope of the necessary analyses and typically require deep technical expertise to be used effectively.
Continue reading Continue readingTIA Project Parser
While working on an OT project, we looked into TIA Portal1 project files to extract more information about changes, especially timestamps to be able to reconstruct a timeline. The TIA Portal (Totally Integrated Automation Portal) allows to create and upload programs for PLC (Programmable Logic Controller) devices often used in the OT (Operational Technology) landscape. Some attacks are able to find the workstation with the TIA Portal and manipulate the project to reprogram the PLCs. To be able to reconstruct the timeline of these changes we wanted to be able to read the timestamps of events from the TIA project files.
Continue reading Continue readingYour Android Bluetooth Traffic Captures Should Be Live
In this post I want to talk about a very essential part of my workflow when dealing with Bluetooth devices, particularly IoT devices with a corresponding mobile app: Live capture of Android Bluetooth traffic with Wireshark.
Before you stop reading because you think you know how to do this already, the method does not involve pulling bug reports off your phone, and it does not require root. And most importantly it gives you a live packet log in Wireshark.
Continue reading Continue readingWindows Hello for Business – Full Report Has Been Released
Yesterday, the BSI (the German Federal Office for Information Security, or Bundesamt für Sicherheit in der Informationstechnik in German) published the first result document from the “Windows dissected” (ger.: “Windows seziert”) project: our analysis of Windows Hello for Business (WHfB). If you have followed this blog over the past year, you have seen the pieces. The full 170-page report has now been published. And it can be downloaded from the project page.
Continue reading Continue readingInsights into Entra ID’s (Un)Conditional Access
When looking at security measures in Microsoft Entra ID environments, a common recommendation is to implement Conditional Access policies.
Whether Conditional Access is implemented can be quickly checked, and you can put a check mark next to it in your best-practice compliance form. However, simply implementing conditional access will not provide much security. A phishing attack that we recently analyzed highlights this very well.
Continue reading Continue readingCVE-2026-47237 – Overly Permissive Istio Permissions Allow Kubeflow Authorization Token Stealing
Kubeflow is vulnerable to the theft of authorization tokens by any user of the
Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With
this token, the attacker can take over the user’s account and the data that is
processed by that user. The attacker needs a valid user with the kubeflow-edit
or Contributor role in a random Kubeflow namespace to perform this attack. This
is given if Automatic Profile Creation is enabled. A setup based on the
official manifests prior to version 1.10, and on most other packaged Kubeflow
distributions, is vulnerable.
The Istio edit permissions were removed by Kubeflow in a timely manner. Affected users should update to the latest version to mitigate this issue.
Continue reading Continue readingERNW White Paper 77: Unified Security Hardening with Cross-Platform Native Binaries
When configuring a new device, achieving an acceptable Lynis hardening score is a challenge most practitioners are familiar with.
Continue reading Continue reading