From Subscription to Backdoor Intruder
summary
Research finds that Azure B2B guests with billing permissions in their home tenant can create and own subscriptions in external resource tenants without directory privileges, a path Microsoft confirms appears in the wild. The chain uses an Azure free trial to gain billing roles, invites to become a guest, guest-created subscriptions, VM provisioning to implant a device-identity backdoor, harvesting with ADInternals and device‑code fishing to obtain a primary refresh token, and a managed‑identity pivot; an offensive toolkit automates the steps and Microsoft updates docs and mitigation policies.
AI-written summary · about
chapters (19)
- 0:00Research mystery intro
- 2:07Azure Entra ID basics
- 6:41B2B guest federation
- 9:31Billing and subscriptions
- 12:43Undocumented guest behavior
- 14:56Microsoft’s response
- 16:01Reliable attack vector
- 19:12Inherited management roles
- 22:45Device identities and zero trust
- 27:08Device identity backdoors
- 29:17Primary refresh token theft
- 31:03Lateral movement via VMs
- 32:49Silencing alerts and persistence
- 35:18Managed identities and credentials
- 37:07Self-uninviting for persistence
- 38:11Offensive toolkit demo
- 39:36Microsoft’s defense updates
- 41:00Key defense policies
- 43:51Conclusion and Q&A
related talks
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators
38mAll You Need is Guest
47mExternal collaboration with Azure AD B2B
34mBingBang: Hacking Bing.com (and much more) with Azure Active Directory
49mAll You Need Is Guest
58mPrivilege Escalation in Microsoft Azure
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
51mAdvanced Attack Vectors in Azure Environments