Last time I dealt with MSRC
Found a cleartext phishing vector on https://t.co/RRzamXQqsd
5 months without response, they woke up when I mentioned "public disclosure"
They rewarded 1 of the many issues I reported. The others : "working as intended"
https://t.co/nVcJgyDbTz
@I_Am_Jakoby It took 5 months. I requested an update every week. No communication, no details about what was fixed. Incorrect bounty amount in the end. Worst experience I ever had, I consider not reporting again.
Je preshot avant la catastrophe : je n'étais pas maître des mes actions, ni du contenu diffusé dans le reportage 🫠
Il ne représente pas la réalité de notre métier, mais bon, faut que les aînés puissent comprendre...
If someone catches you sneaking in 007 First Light, the main character will come up with an excuse which is actually genius instead of getting a mission failed screen or raising alarm.
@podalirius_ Exact same experience on official login page phishing, marked as "important"... Got a bounty however, after 5 months of silence from MSRC. Won't report ever again.
Here's the talk for the next meetup!
🎙️ "Your cloud identity providers are phishing platforms" - by @MrSheepSheep
📅 19/04
📍 Oculto, 27 R. Quincampoix, 75004
🕖 19:00
Registration on our website
@I_Am_Jakoby The acknowledgements page has not been updated since March. Maybe they only update it once every 3 months or so.
You did nothing wrong. MSRC don't care, they won't even try to retain you from leaving. Build upon your research, go public, do talks, make it your own.
@UK_Daniel_Card .. such as bypassing MFA policies during redteam engagements ! Enroll your own token when the user does not own one. It's more trusted than push notifications (in the case of Okta), and essentially makes it a 2FA backdoor.
Hello, small error on the date the meetup will be held on May 19.
Program:
🎙️ "Your cloud identity providers are phishing platforms" - by @MrSheepSheep
🎙️ "Understanding EDRs to better bypass them" - by CursedFRA
📍 Oculto, 27 R. Quincampoix, 75004
🕖 19:00
See you there !
Here's the talk for the next meetup!
🎙️ "Your cloud identity providers are phishing platforms" - by @MrSheepSheep
📅 19/04
📍 Oculto, 27 R. Quincampoix, 75004
🕖 19:00
Registration on our website
@I_Am_Jakoby It took 5 months. I requested an update every week. No communication, no details about what was fixed. Incorrect bounty amount in the end. Worst experience I ever had, I consider not reporting again.
@hyusapx@freemanjiangg Problem is, the audio source (screenshare) cannot be delayed because it's being sent to the app. A trick could be to pull audio from a tab and share it to another, mute it and replay the synced buffer from the app (if mute doesn't mute the screenshare), or some trickery like that
I briefly documented the technique for anyone interested. It applies to pretty much all cloud identity providers. https://t.co/y7ZmETjsbU
I'm essentially extending @_xpn_ incredible work, focusing on the phishing part :)
Don't log in to unknown Okta tenants. Double-check organization URLs before logging in.
It is possible to abuse Okta to harvest cleartext credentials sent through the login form.
Actually, a similar attack vector (OktaJacking) was found by PushSecurity : https://t.co/IOGZbmWeWj
But it required knowing usernames beforehand. Using an LDAP agent, that's not required.