Detected - A Hard Matching Vulnerability Which Enables Azure AD Account Takeover

The identity security pioneer, Semperis, has uncovered an abuse of hard matching synchronisation in Azure AD Connect that can lead to Azure AD account takeover. These findings build on the research that Semperis published in August, which described abuse of soft matching (also known as SMTP matching).  
 
This SyncJacking vulnerability means that an attacker with certain privileges can abuse hard matching synchronisation in Azure AD Connect to completely take over any synchronised Azure AD account  - including Active Global Administrator.   
 
These findings were promptly reported to the Microsoft Security Response Center (MSRC), which updated hardening guidelines to provide more specific mitigations against hard matching abuse. While MSRC rapidly responded and updated the hardening guidelines, further testing shows that the attack can succeed even after these mitigations are implemented.

It’s strongly advised to take extra mitigation to combat abuse and potential Azure AD account takeover and it’s important to note why attackers might exploit this method:   

  • The use of hard matching to facilitate Azure AD account takeover leaves no trace in on-prem AD logs and only minimal trace in Azure AD logs.  
  • The attack requires only two permissions on target accounts to completely take over any synchronised account with any role.  
  • An attacker who possesses relatively high permissions in AD can take over Azure AD by taking over any synchronised account with an Active/Eligible assignment.  

Potential Abuses  

User delegation:   If a user or group has been delegated control to manage users in one or more organisational units (OUs) with synchronised and unsynchronised users, then that user or group has full control on these objects and can hijack any of them - theoretically even becoming a Global Administrator.  

Account Operators:   Any user in the Account Operators group can manage all accounts and has account creation privileges. Therefore, any Account Operator can hijack any synchronised users.  

How To Detect A Syncjack Abuse 

You can reasonably (although not definitively) assume that this attack has occurred if two log events occur one after another in Azure AD: “Change User Password” followed by “Update User” with a changed DisplayName and a target that uses the same UPN.   Semperis Directory Services Protector (DSP) collects Azure AD changes and on-premises AD data and uses this data to detect attempts to exploit this vulnerability. Despite the minimal traces left by the attack, DSP’s specific capabilities enable detection.  

Syncjack Hardening Guidelines For Organisations 

MSRC has updated its guidelines to include the following recommendation:   

Disable Hard Match Takeover:   Hard match takeover allows Azure AD Connect to take control of a cloud managed object and changing the source of authority for the object to Active Directory. Once the source of authority of an object is taken over by Azure AD Connect, changes made to the Active Directory object that is linked to the Azure AD object will overwrite the original Azure AD data - including the password hash, if Password Hash Sync is enabled. An attacker could use this capability to take over control of cloud managed objects. To mitigate this risk, disable hard match takeover.  

Semperis’ testing shows that SyncJacking works even after disabling hard match takeover. Regardless, this hardening guideline is important to apply.  

MSRC states that it is important to enable MFA for all users who have privileged access in Azure AD or in AD. Currently, the only way to mitigate this attack is to enforce MFA on all synced users. This isn’t a surefire way to stop an attacker from accessing your account if SyncJacking is abused, but it can help.

Be sure to follow all hardening guidelines provided by Microsoft in the previous link to mitigate many attack surfaces in your hybrid identity environment. For even greater protection, consider implementing DSP for Identity Threat Detection and Response (ITDR).  

You Might Also Read: 

Azure Active Directory Recycle Bin Won’t Save Your Critical Data:

 

« The Hidden Costs Behind Black Friday Bargains
Shopping Safely Online During Black Friday »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Senetas

Senetas

Senetas is a leading developer and manufacturer of certified high-assurance encryption solutions, dedicated to protecting network transmitted data without compromising performance.

Quotium

Quotium

Quotium provides automated testing technologies to make business software applications secure and robust.

Argus Cyber Security

Argus Cyber Security

Argus is the world’s largest automotive cyber security company, protecting connected cars and commercial vehicles from hacking.

National Defence Radio Establishment (FRA) - Sweden

National Defence Radio Establishment (FRA) - Sweden

The National Defence Radio Establishment (Försvarets Radioanstalt), is the Swedish national authority for Signals Intelligence, also providing Information assurance services to government authorities.

Fair Isaac Corporation (FICO)

Fair Isaac Corporation (FICO)

FICO provides analytics software and tools used across multiple industries to manage risk, fight fraud, optimize operations and meet strict government regulations.

Valtori

Valtori

Government ICT Centre Valtori provides sector-independent ICT services for the central government, while taking into account the special requirements related to security and preparedness.

Council for Information & Communication Technologies (CTIC)

Council for Information & Communication Technologies (CTIC)

CTIC was set up to address specific issues in the field of ICT relevant to the implementation of electronic government.

Montimage

Montimage

Montimage develops tools for testing and monitoring networks, applications and services; in particular, for the verification of functional, performance (QoS/QoE) and security aspects.

Applied Science and Technology Research Institute Company Limited (ASTRI)

Applied Science and Technology Research Institute Company Limited (ASTRI)

ASTRI's mission is to enhance Hong Kong’s competitiveness in technology-based industries through applied research in areas including Security & Data Sciences which encompasses cybersecurity.

NanoLock Security

NanoLock Security

NanoLock delivers the industry’s only end-to-end platform for the IoT and connected devices ecosystem.

S2T

S2T

S2T builds cyber intelligence solutions based on deep expertise in diverse domains such as intelligence, machine learning and AI, big data processing, statistics and linguistics.

AttackFlow

AttackFlow

AttackFlow is a static code analysis company which develops innovative solutions for secure app development.

Mias TSCM

Mias TSCM

Mias TSCM provides Cyber TSCM (Technical Surveillance Countermeasures) bug sweeping services.

Foundries.io

Foundries.io

Foundries.io have built a secure, open source platform for the world's connected devices, and a cloud service to configure this to any hardware and any cloud.

Brandsays

Brandsays

Brandsays is a unique online security solution, allowing brands to warn their consumers in real time if they visit a fraudulent website.

RecoLabs

RecoLabs

Reco’s proprietary AI technology dynamically maps business interactions within your collaboration tools to identify sensitive assets shared and uncover incidents that are relevant to your business.