BingBang: Hacking Bing.com (and much more) with Azure Active Directory
summary
A single misconfiguration — a single checkbox when creating a multitenant Azure AD app — allows authentication bypass by spoofing tenant IDs, enabling edits to a Bing admin panel that modify live Bing search results and inject XSS to steal Office 365 tokens. A custom remote scanning technique uncovers scale: about 1,300 vulnerable apps from ~5,000 multitenant apps scanned across 500+ organizations. Exploits produce real Office 365 access tokens and live content changes; Microsoft changes docs, blocks tenant substitution by default, adds an allow tenants option and pays a $40,000 bounty.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:05Who am I
- 3:00What are Identity Providers
- 3:38What is Azure Active Directory
- 4:54What happens behind the scenes
- 5:39Research
- 8:44Tenant ID
- 11:01Scanning the Internet
- 13:01Fingerprinting Apps
- 14:53What we found
- 17:00Who has the best B routing program
- 18:17Demo
- 26:12Other Microsoft Web Apps
- 28:50Microsofts Response
- 32:41Questions
related talks
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
50mAttacking and Defending the Microsoft Cloud (Office 365 & Azure AD)
31mPiloting Edge Copilot
30mPhishing for Tenants: All I Wanted was for Microsoft to Deliver my Phishing ...
51mAdvanced Attack Vectors in Azure Environments
55mOffensive Azure Security
45mFrom Subscription to Backdoor Intruder
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech