Security News > 2021 > January > SVR Attacks on Microsoft 365
![SVR Attacks on Microsoft 365](/static/build/img/news/alt/malware-statistics-2-scaled-medium.jpg)
Steal the Active Directory Federation Services token-signing certificate and use it to forge tokens for arbitrary users.
This would allow the attacker to authenticate into a federated resource provider as any user, without the need for that user's password or their corresponding multi-factor authentication mechanism.
Modify or add trusted domains in Azure AD to add a new federated Identity Provider that the attacker controls.
This would allow the attacker to forge tokens for arbitrary users and has been described as an Azure AD backdoor.
Compromise the credentials of on-premises user accounts that are synchronized to Microsoft 365 that have high privileged directory roles, such as Global Administrator or Application Administrator.
Backdoor an existing Microsoft 365 application by adding a new application or service principal credential in order to use the legitimate permissions assigned to the application, such as the ability to read email, send email as an arbitrary user, access user calendars, etc.
News URL
https://www.schneier.com/blog/archives/2021/01/svr-attacks-on-microsoft-365.html
Related news
- New Latrodectus malware attacks use Microsoft, Cloudflare themes (source)
- Microsoft warns of "Dirty Stream" attack impacting Android apps (source)
- Microsoft fixes Windows zero-day exploited in QakBot malware attacks (source)
- Microsoft fixes a bug abused in QakBot attacks plus a second under exploit (source)
- Cybercriminals Exploiting Microsoft’s Quick Assist Feature in Ransomware Attacks (source)
- Microsoft Warns of Surge in Cyber Attacks Targeting Internet-Exposed OT Devices (source)
- Microsoft launches cybersecurity program to tackle attacks, protect rural hospitals (source)