vibekeron.blogg.se

Most of the phishing URLs were abusing Microsoft’s Azure domains to host the phishing attacks, making them look more legitimate. They’ve successfully targeted hundreds of users of Proofpoint customer tenants, and the numbers keep growing daily.Īll the third-party applications were being delivered through a Microsoft URL with a missing response_type query parameter, with the intention to redirect unsuspecting users to different phishing URLs. The attacks use dozens of distinct Microsoft 365 third-party applications with malicious redirect URLs defined for them. We analyzed Proofpoint data and found large-scale targeted attacks using modi operandi (MOs), which we’ll discuss in detail later in this blog post. Real attacks targeting Microsoft’s OAuth implementation

This makes the attack sequence more covert and potent compared to classic open redirection attacks. The victim who clicks on the URL trusts the OAuth provider and doesn’t expect an immediate redirection, as we observed in this type of attack. In the new flavor we discovered, the redirection target URL is configured in the OAuth provider’s framework, without any validation of this URL.Īlso, the redirection target URL will be missing from the legitimate URL and will therefore bypass most phishing detection solutions and email security solutions. Classic open redirection attacks will hold the redirection target in the URL itself. An attacker can craft a URL for a web application that causes a redirection to an arbitrary external domain. Open redirection vulnerabilities arise when a web application incorporates user-controllable parameters to specify a redirect link. Proofpoint threat researchers started detecting these redirection attacks against Microsoft 365 environments in February 2020. Third-party cloud applications use OAuth 2.0 to obtain limited access to protected users’ resources in major platforms such as Microsoft 365 and Google Workspace. Proofpoint has discovered several new, previously unknown methods to initiate a URL redirection attack using Microsoft and others’ popular OAuth2.0 security implementations.