Tokens & Takeovers: Cloud-Powered Supply Chain Attacks

No ratings

Presented at Bluehat / BlueHat India 2024 by

Nitesh Surana

Gaurav Mathur

It takes one single misconfigured token to jeopardize cloud resources and their downstream dependent systems; a recent example being an overly permissive SAS token leading to the 2023 leak of 38 TB of Microsoft Al research data. After Microsoft's account of the incident, we did our own part in hunting for overly permissive SAS tokens. We found two different ways of controlling a widely used official Microsoft tool called PC Manager. One could eventually execute a classic supply chain attack across multiple releases of MS PC Manager that were sprinkled across the web in multiple blogs, support forums using 'aka.ms' URL shorteners, an official Microsoft website and WinGet packages. Using the SAS tokens, we could takeover every release of MS PC Manager. Furthermore, we will share our findings wherein one could inject malicious stored procedures on database backups for tutorials mentioned in official Azure docs, modify JavaScript resources being used on multiple websites using one single SAS token. To conclude, we will share what practitioners can do to proactively hunt for sensitive information in URL parameters such as SAS tokens in their environments.