D Lind

Tweets are my own. Lucky guy who works with his hobby. 👨🏼‍💻 Here for the awesome knowledge in the MSFTverse, threat intelligence and FPL tweets.

[Fabian Bader @fabian_bader]

Entra Connect v2.6.79.0 was just released and contains undisclosed security fixes and @Microsoft recommends to update fast. On the bright side, it will finally support FIDO2 based authentication!

[Merill Fernando @merill]

Folks, I just released Lokka 2.0 today!

The world's first Microsoft Graph MCP server is now a full blown MCP App.

First up multi-tenant support. You can now sign into more than one tenant.

What does it mean?
1/16

[D Lind @dnsinit]

@merill What did i miss? 😵

[GitHub @github]

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories.

Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

[Nathan McNulty @NathanMcNulty]

Entra App Proxy continues to be one of the biggest hidden gems of Entra P1

For over a decade, we've been able to stop exposing risky apps to the Internet by routing through agents with outbound connections to Azure

I don't care what vendor you use, just get it off the Internet

[D Lind @dnsinit]

@merill Looking forward to following you on your journey Merill, hope you will still be able to show up at remote locations like ELDK 😁

[D Lind @dnsinit]

Finally patch time…
Welcome back CA policies that were magically erased from everyone’s logs for quite a while. 🧙‍♂️

[D Lind @dnsinit]

@UK_Daniel_Card @bettersafetynet @shenetworks @BHinfoSecurity count me in, mad that.

[Nathan McNulty @NathanMcNulty]

@techspence @laplanted24 @magicswordio @ThreatLocker Without changing a single thing, you can create an alert and automate remediation if you wanted

They publish queries that pull the latest domain names lists and hunt for you ;)

https://t.co/NB6MEzPV0p

[D Lind @dnsinit]

@UK_Daniel_Card It’s slow 🥲

[D Lind @dnsinit]

@merill This is amazing Merill! 🤩

[International Cyber Digest @IntCyberDigest]

❗️🚨 Microsoft Edge keeps every saved password in process memory as cleartext from the moment it launches. Microsoft's responsed when reported: "by design."

All of them. Including credentials for sites you won't open this session.

Researcher @L1v1ng0ffTh3L4N tested every major Chromium browser. Edge is the only one that behaves this way.

Chrome decrypts credentials on demand, and App-Bound Encryption locks the keys to an authenticated Chrome process so other processes can't reuse them.

In Chrome, plaintext surfaces only during autofill or when a password is viewed, making memory scraping far less useful.

What makes this extra weird is that Edge still demands re-authentication before revealing those passwords in its Password Manager UI, while the same browser process already holds every one of them in plaintext.

In shared environments, this turns into a credential harvest. On a terminal server, an attacker with admin rights can read the memory of every logged-on user process. In the published PoC video, a compromised admin account lifts stored credentials from two other logged-on (and even disconnected) users with Edge running.

Microsoft's official response when notified: "by design."

The finding was disclosed April 29 at BigBiteOfTech by PaloAltoNtwks Norway, alongside a small educational tool that lets anyone verify the cleartext storage for themselves.

[Merill Fernando @merill]

Stop using UPNs for Entra ID automation. It’s a ticking time bomb. 💣

If a user changes their name (marriage/rebrand), your logic breaks.
The result? Wiped laptops, broken groups, and "forever access."

Here is how to build a stable identity lifecycle. 🧵
1/5

[Nathan McNulty @NathanMcNulty]

ICYMI - You can instantly hybrid join devices without ADFS or Entra Connect Sync using Entra Kerberos

https://t.co/SkwYZdmZ4a

[D Lind @dnsinit]

@ClassyGull @NathanMcNulty @IAMERICAbooted That’s no problem at all, but they can’t have the role-assignable property set to true

[D Lind @dnsinit]

@richardhicks @merill Was a great listen!

[D Lind @dnsinit]

@DanielatOCN @PyroTek3 Ah right, I only ever user the service to translate a domain name to tenant id without authenticating so didn’t think about the additional use cases 😅

[D Lind @dnsinit]

@SwiftOnSecurity For that countermeasure to be somewhat effective we also need universal CAE for to make sure access tokens can be revoked too… although I didn’t read up on the details in this case, perhaps CAE was in fact in play :)

[D Lind @dnsinit]

@drbirrdie @SwedishPM Yes, I’m sure they’d brag about a mistake like that on social media 😂