#tokentheft — Public Fediverse posts

Key Points:
➡️ Malicious PyPi package 'pycord-self' targets Discord developers, stealing authentication tokens and creating a backdoor for remote control.
➡️ Introduced in June 2024, downloaded 885 times.
➡️ Token theft and backdoor installation are the primary malicious functions.
➡️ Developers should verify package sources, review code, and use scanning tools to enhance security.

https://news.lavx.hu/article/malicious-pypi-package-poses-threat-to-discord-developers-a-deep-dive

#PyPI #DiscordAPI #CyberSecurity #TokenTheft #Backdoor #Malware #DevOps #Python

Microsoft Entra ID Token Protection is a security feature within Microsoft Entra's Conditional Access that aims to mitigate token theft by ensuring that a token can only be used from the device it was issued to. This is achieved through a process called token binding, which creates a cryptographically secure link between the token and the device.

If a threat actor were to steal a token, without the corresponding client secret from the device, the token would be rendered useless.

This protection is particularly important because token theft, while relatively rare, can lead to significant security breaches if the threat actor impersonates the victim until the token expires or is revoked.

Do you want to learn more about token protection and how to enforce it in Microsoft Entra ID? Read my latest blog post! 👇👇

https://www.cswrld.com/2024/04/microsoft-entra-id-token-protection-explained/

#entraid #authentication #tokenprotection #tokentheft #conditionalaccess #cybersecurity #tips

I'd like to point out this really interesting article on the topic: 𝐓𝐨𝐤𝐞𝐧 𝐓𝐡𝐞𝐟𝐭 𝐓𝐚𝐥𝐤.

Key points and topics covered:

- Primary Refresh Tokens (PRT) on all operating system platforms have been hardened against theft from day one. The level of protection depends on operated system capabilities, with Windows offering the strongest protection.

- First line of defense against token theft is protecting your devices by deploying endpoint protections, device management, MFA (and moving towards phishing-resistant credentials), and antimalware

You can reduce token theft by carefully orchestrating Entra ID security products:

▶Addressing token theft of sign-in session artifacts: Conditional Access: Token protection policy offers cryptographic protection against replay of stolen tokens.

▶Addressing token theft of app session artifacts: block usage of stolen access tokens and workload cookies outside of your corporate network by using Conditional Access.

▶Detecting token theft: enable risk detections with Microsoft Entra ID Protection to elevate user risk when token theft is suspected.

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/addressing-data-exfiltration-token-theft-talk/ba-p/3915337

#microsoft #microsoftsecurity #entraid #azuread #azure #idp #token #tokentheft #cloudsecurity #identity #prt #cookies #identityprotection #mfa #cae #conditionalaccess #refreshtoken #token

Microsoft has been published a very good summary about #AzureAD security trends in 2023 which considered post authentication attacks, such as #TokenTheft: https://microsoft.com/en-us/security/blog/2023/01/26/2023-identity-security-trends-and-solutions-from-microsoft/

If you are interested to learn more about Token replay attacks, check the following blogs:

🔗 Token tactics: How to prevent, detect, and respond to cloud token theft by Microsoft DART team: https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/

This article describes Adversary-in-the-middle (AitM) phishing/Pass-the-cookie attack scenarios and recommendations.

🔗 Abuse and replay of Azure AD refresh token from Microsoft Edge in macOS Keychain:
https://www.cloud-architekt.net/abuse-and-replay-azuread-token-macos/

I've written this blog post about token replay on #macOS devices last year. It covers an attack scenario to exfiltrate tokens from Keychain which is used to store cached Azure AD tokens for “logged in” Edge profiles on macOS devices.

🔗 Azure AD Attack & Defense: Replay of Primary Refresh (PRT) and other issued tokens from an Azure AD joined device:
https://github.com/Cloud-Architekt/AzureAD-Attack-Defense/blob/main/ReplayOfPrimaryRefreshToken.md

A comprehensive overview about attack and defense scenarios primary refresh token (PRT) & other tokens on Windows has been published by Sami Lamppu and and me. The article includes many references and links to other community resources around this topic.

@datenschutzbochum

"Threat actors are stealing #authentication tokens already verified by multifactor authentication (MFA) to breach organizations' systems"

Seems to be a pretty nasty attack as organizations haven't considered #tokentheft as part of their #incident response plan....🤨

#cybersecurity #cyberattack #mfa #microsoft