One Drive, Double Agent: Clouded OneDrive Turns Sides
summary
Research shows OneDrive local logs expose an odls token leak that lets an unprivileged process steal the victim’s cloud token after creating Junction symlink links inside the sync folder to mirror arbitrary user folders. The attacker uploads the token to the victim’s OneDrive, shares it to an attacker email, and uses the token to make OneDrive itself perform mass encryption, delete versions/recycle via mobile APIs, and later run replaced SharePoint binaries to delete Shadow Copies (requires admin/UAC). A tool called DoubleDrive implements the flow and demos bypasses of EDRs, CFA and decoy-file defenses.
AI-written summary · about
chapters (11)
- 0:00Research introduction
- 1:46Undetectable ransomware goal
- 3:11OneDrive as double agent
- 6:43Recruiting OneDrive
- 9:30Exfiltrating access token
- 12:01Disabling recovery features
- 18:50Deleting Shadow Copies
- 25:42Bypassing EDRs
- 32:33Introducing DoubleDrive
- 35:26Key takeaways
- 38:18Q&A
related talks
54mCredential Sharing As A Service: The Dark Side Of No Code
48mLateral Movement in the Age of Hybrid Cloud
53mAbusing Cloud Apps 101: Command and Control
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
23mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
36mAikido: Turning EDRs to Malicious Wipers Using 0-day Exploits
26mTechnical Tracks
54mCredential Sharing as a Service: The Dark Side of No Code