so as mentioned um i am
currently a senior scientist at security
risk advisors uh which is actually um a
new job for me and very excited about
that so i do a lot of uh research and
innovation and focus on cloud security
engineering and architecture before that
i was um an 865 sysadmin so that's kind
of my area of expertise a little bit
more so than many other things um and
i'm also grad student computer science
so basically i'm just damascus and have
no free time um as well as being a blue
team village organizer so here at def
con you'll probably see me around quite
a lot if you stop into blue team village
to our discord or wherever else
and so i'm gonna just hop right into it
um
so the title of this talk is exploiting
the o365 duo two factor
um loophole or misconfiguration so i'm
going to talk a little bit about what
the scope of this actually is this
applies to office 365 uh on azure's or
on an azure tenant um on which all basic
authentication is not fully blocked and
we'll touch on that a little bit uh
later as well
um and this is
happening on tenants where two-factor
authentication or two-factor
verification with uh duo is implemented
um and it's applies to configurations
most likely implemented prior to august
2020 or thereabouts
which i will get into
um so for a quick background in order to
understand kind of what's going on here
um there are a couple o365
authentication types so
microsoft being microsoft uses its own
terminology
so what it refers to as legacy auth is
is basic authentication
and these are protocols that send
username password in header um
in plain text essentially unless they're
unless they're sent via https or some
other protocol uh modern authentication
refers to a slightly different
methodology with client server
authentication uses access and refresh
tokens
and importantly
modern authentication is a requirement
in order for two-factor verification or
any other mfa service to actually work
so that's a very important point
and then we also have some email
protocols that may be familiar to people
pop imap smtp are all legacy
authentication protocols although there
is support for modern being built into
them
the second one activesync is going to be
the most important one here and then
there are other ones like mappy rpc and
these are used uh for
services like microsoft outlook
so
what is this misconfiguration
so the first thing i want to clarify duo
is not actually part of the
misconfiguration this is entirely on the
office 365 side of the equation
duo's documentation explicitly notes
that
modern authentication is required in
order for for this duo to be triggered
so that is a very important point here
that they actually do make clear
um the second part of this is
conditional access policy is an azure
active directory so o365 as a tenant use
it's essentially backed by azure active
directory and all access is run through
active directory um and the
configuration that duo requires in order
to work with o365 actually involves
conditional access policy
and what's called a custom control
that basically enforces an action e-i-e
triggering a dual authentication
to
a selected set of users uh cloud apps or
actions and conditions
uh if configured and then finally will
you know you can write a policy to
either perform an action or deny access
period
and this access grant is where the duo
integration
actually happens and what sends it off
to to duo to be
to go through that second factor
um so let's take a look at what that
looks like
so essentially under when you're
configuring conditional access policy
you have all of those previously listed
uh assignments and access um under the
uh configuration in azure active
directory in the security portion um
under conditional access so importantly
when you have conditions you have
options to kind of scope an action a
grant or deny by
something that you select one of those
things being client apps so this was in
preview before august 2020 which is kind
of why
this uh
is this misconfiguration has happened
probably as widely as it has
um so you'll notice that first of all
so this year right here is actually the
current one um and i'll show you a
little bit what the previous one looks
like and why that would be an issue but
you'll notice that activesync is listed
separately and in the new configuration
it's listed as legacy authentication
client so there are some exchange active
sync clients that are actually
integrated with modern authentication
but that is not necessarily um not
necessarily the case and it doesn't
really indicate that it's always going
to be under modern off if it has a basic
authentication
workflow
so
if not checked in this is this example
this duo policy which operates under the
condition of whatever users you select
conditions client apps all these three
or just the top two which would be make
sense to most people um it essentially
means that uh activesync would not be
triggered um to to be pushed out to to
duo
and then another previous um
configuration that people have used is
actually creating a second conditional
access policy that explicitly blocks
uh legacy authentication clients however
in the previous configuration the only
one that this actually applied to would
be other clients
the way it it actually appeared because
those are the commonly listed ones like
pop and imap so activesync is kind of
this weird uh protocol that's hanging
out separately and is a bit
misunderstood when someone like a
systems administrator who may not be as
familiar with it
is configuring this policy
so
if we leave out activesync what does
this look like
so if you go into uh
ios
mail the regular mail application not
outlook for ios
and you go and you you hit you know
microsoft exchange account you sign in
if you sign in with a company account
you'll get a pop-up from microsoft you
enter your password this window
will
uh will trigger the duo prompt to
actually happen so it's essentially this
is reaching out even if activesync is
not actually triggered
so
there is basically ios has support for
supporting
modern authentication and triggering
that duo prompt
right in its own application
so after signing the dual prompt would
show up cool enter your password and
bob's your uncle or whatever that weird
expression is that's the normal workflow
that's how people normal users would
actually expect to be able to configure
uh mail on the apple ios application
however
if you actually cancel out of that
previous window
or
configure manually you can actually
configure the the active sync
basic authentication side of the
equation and wind up skipping the prompt
entirely
and that is literally how this that how
this exploit actually works
it's essentially fail out of the the uh
duo two factor prompt or skip it
configure manually for activesync and
because we have that hole where con
conditional access policy was not
actually applied uh to
to that conditional access policy
then this is what we wind up with the
ability to do this and honestly you know
this is something that when researching
you kind of go through this from this
perspective of an end user who is just
going to be able to all they want to do
is sign up for their email and they're
not going to notice whether or not
they're you know being prompted for for
duo or not in fact they'll probably be
happy not to be prompted for it
but that is essentially how to do it on
ios and it still works i've actually
tested it this week
so um and this is also important to note
because activesync is a protocol
something that you can build right into
an application or you know run a script
and password spray on an ec2 instance in
aws if you want to
basic authentication literally is just a
basic c4 encoded header edition that
states what the authorization is it's
basic includes username and password
that's it pretty easy um in addition to
that activesync gives clients access to
email contacts calendars and other
things not just email
but it also has no ability to enforce uh
authorization
uh aside from that initial
authentication so it essentially grants
access to everything which is why it can
be such a
lucrative exploit if you would like it
to be or why you should be a little
nervous if you don't want it to be so
why does this happen
uh prior to august 2020 on the left side
this image shows that
activesync was actually not listed or
explicitly mentioned as being a legacy
authentication protocol
so uh when um
when customers have configured things
like um this second policy is mentioning
to actually block
um basic authentication they may have
gone right to that other clients notice
that that had pop imap and thought that
that's all that they that
that was needed to block and that's not
necessarily the case
the updated version of configuration
makes it a lot more clear fortunately
um the other thing is that client apps
was in preview before august 2020
and
previously
it actually stated that
conditional access policies by default
applied to browser-based applications
and applications that utilize modern
authentication protocols which meant it
only applied when it was able to apply
and did not impose any kind of automatic
block or um implicit deny behavior
um in 2020 that actually uh changed so
when you apply a policy even if it's
you know if you select active sync and
it does not um
and and your client is using basic
authentication it at least sees that
it's supposed to be enforcing with
modern authentication and prompting and
it actually fails out
that behavior is is newer
and then the behavior of the client apps
condition as well was updated in 2020 so
previously uh you know it wouldn't
implicitly block anything or apply to
to for
all those four um
options on the right hand side
um and as of after 2020
it actually checks all of them by
default so if a configuration was done
after august 2020
with similar steps everything would be
checked off by default and this hole
would not exist because of that
um
so i know i'm really probably pretty
sure on time at this point
so um just a quick um note for for
actually finding this in a client if
you're office 365 administrator and have
access to the azure active directory uh
blade in azure um if you actually search
for client app exchange activesync
you'll actually see it and that is only
going to show you the basic
authentication side of activesync
clients um it fully re-authenticates so
you'll actually see frequent um
frequent authentication actions which is
actually pretty cool um just a quick
note on this though
the few minutes
thank you
um
so uh note about this i just dropped a
quick little splunk query in here this
should catch most of everything and give
you kind of a breakdown of who's using
it um
but the sign-in logs are actually more
accurate when they're
used accessed through the um
i think the um
people say you at uac united
unified activity log that's it um
unified audit logs in powershell and
also in logs as as they're configured
propagated to splunk rather than in the
portal because
in the portal it shows you in the list
before you click details it will show
you the client app and they'll say
conditional access success even if
conditional access was not applied as
you can see in that graphic there this
is really important because if your
sysadmins just looking really quickly
they're going to think that conditional
access is working when it is actually
not even being applied so very important
point right here
um so the first thing you can do to fix
this is tweak conditional access policy
just include everything um again it's
much easier now that this has been
reworked by microsoft to actually
do an implicit deny
on um on the applications that don't
meet the protocol for what uh for what
this is
um and the end behavior is the client
can authentic active sync and it looks
like they can load an account but they
can't view anything and we'll get a
message saying hey you don't have access
to anything which is actually pretty
cool too and they were um and then you
can also just disable legacy
authentication altogether please do it
please kill
legacy off
it is bad
that's kind of a uh
a universal truth uh but realistically
we know that many um clients are still
using it you're always gonna have that
person who just has to use thunderbird
or pine or whatever and uh they're
probably a vip
so um just make sure to do due diligence
if you're enrolling users into factor
via duo you're going to want to make
sure that your conditional access policy
covers everything basic is auth is
disabled for new tenants uh 365 tenants
and existing tenants that have zero use
of basic off so if you've got one user
your tenant has not disabled basic
authentication
plenty more resources on this happy to
answer questions
and that's it that's all i got