How To Protect Azure Active Directory From Undetected Brute-Force Attacks?

Security researchers identified a flaw in Azure AD (Active Directory) Single Sign-On protocol which could let an attacker perform single-factor brute-force attacks against Azure AD (Active Directory) without generating sign-in events. Let’s see how to protect Azure AD (Active Directory) from undetected brute-force attacks.

What Is Azure Active Directory?

Azure Active Directory is Microsoft’s enterprise cloud-based Identity Service Provider which provides IAM (Identity and Access Management) solutions to the enterprise apps from any ware. Azure AD offers Single Sign-On, Conditional Access, and multi-factor authentication services to the apps. It helps organizations to securely manage the user from on-premises or remote locations. It automates workflows for user lifecycle and provisioning. It saves both time and resources with self-service management.

How Does Azure AD Seamless Single Sign-On Work?

The prime function of Azure AD Seamless Single Sign-On is to facilitate a user in managing his auto logins. Seamless SSO ensures the user doesn’t need to log in to the Azure AD when he has logged in to his computer with his domain account. When Seamless SSO is configured on the Azure AD, a computer object named AZUREADSSOACC will be created on the on-prim AD domain with a Service Principal Name (SPN), a unique identifier of a service instance for a service logon account during Kerberos authentication. On-premises AD will send the name and password hash of the AZUREADSSOACC computer object to the Azure AD so that Azure AD will accept Kerberos tickets through the Autologon service.

How Attackers Abuse Azure AD Seamless SSO Flaw To Perform Undetected Brute-Force Attacks?

The flaw exists in the Azure AD Seamless Single Sign-On, a service that allows users to login Azure AD without entering the username and passwords when they are connected to the corporate network.

Table 1. Autologon error codes.
These error codes are developed to know the cause of the problem. However, attackers utilize these error codes to discover the account information. The real threat lics in the logging information. As per the design, successful authentication events generate sign-in logs in step 2. Autologon authentication to Azure AD is not logged. This means initial login attempts are not logged. However, Autologon authentication failure events are logged. This feature allows the attacker to carry out the brute-force covering under the radar. This flaw could create a massive disruption if attackers could find the correct combination of username and password. For organizations, It is important to know how to protect Azure AD (Active Directory) from undetected brute-force attacks.

How To Protect Azure Active Directory From Undetected Brute-Force Attacks?

Logs are the main source to examine the activities of a system. Logs play a vital role in the analysis of incidents. Since there are no login attempt logs were generated, it is highly difficult to detect brute-force attacks. Since this flaw is by design. There are no clear mitigations to address this flaw. This has to be fixed only at the Vendor level. By the way, Microsoft has responded to this flaw and working to implement these things with the release of monthly patching updates.

The above two updates can defend the Azure AD from such brute-force password spray attacks. However, they can’t completely prevent the attacks. It’s the tenant’s responsibility that how efficiently they manage Seamless SSO and authentication logs.There are some best practices. Such cyber-attacks can be prevented by following them.

We hope this post would help you in protecting Azure AD (Active Directory) from undetected brute-force attacks. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.

You may also like these articles: