{"id":50320,"date":"2023-01-26T20:00:00","date_gmt":"2023-01-26T20:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/saas-rootkit-exploits-hidden-rules-in-microsoft-365-"},"modified":"2023-01-26T20:00:00","modified_gmt":"2023-01-26T20:00:00","slug":"saas-rootkit-exploits-hidden-rules-in-microsoft-365","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/saas-rootkit-exploits-hidden-rules-in-microsoft-365\/","title":{"rendered":"SaaS RootKit Exploits Hidden Rules in Microsoft 365"},"content":{"rendered":"

Microsoft is a primary target for threat actors, who scour Microsoft applications for weaknesses. Our security research team at Adaptive Shield recently discovered a new attack vector caused by a vulnerability within Microsoft’s OAuth application registration that allows attackers to leverage Exchange’s legacy API to create hidden forwarding rules in Microsoft 365 mailboxes.<\/p>\n

To understand this new attack vector, you must understand the key components therein. These include hidden forwarding rules and SaaS-to-SaaS app access<\/a>, all of which amount to a malicious SaaS rootkit that can infiltrate users’ accounts and control their mailboxes \u2014 without the users’ knowledge.<\/p>\n

Learn more about the top use cases<\/a> to secure your entire SaaS stack.<\/p>\n

Hidden Forwarding Rules<\/h2>\n

Inbox rules are actions that occur based on preset conditions within a Microsoft mailbox. Users or admins can use forwarding rules to trigger protocols based on different attributes of the user’s inbox.<\/p>\n

Hidden forwarding rules (Figure 1) were first discovered by Compass Security’s Damian Pflammater<\/a> in 2018. He covered the discovery and Microsoft\u2019s response in a blog post titled “Hidden Inbox Rules in Microsoft Exchange<\/a>.” These rules are fully functional and can be seen on the back end. However, they are not visible common interfaces such as email clients, an admin dashboard, or an API (Figure 2).<\/p>\n

\n\n<\/picture>
Figure 1. Hidden forwarding rules are visible on the back end.<\/figcaption><\/figure>\n
\n\"Figure\n<\/picture>
Figure 2. Forwarding rules don\u2019t appear in searches through common interfaces.<\/figcaption><\/figure>\n

SaaS-to-SaaS Access Through OAuth 2.0<\/h2>\n

SaaS-to-SaaS app access, also referred to as third-party app access, describes the conditions under which one app can connect to another app and, in doing so, gain access and permission to different information and settings. The OAuth<\/a> 2.0 mechanism simplifies the process of authentication and authorization between consumers and service providers through a seamless process that allows users to quickly verify their identities and grant permissions to the app. The app is then allowed to execute code and perform logic within its environment behind the scenes.<\/p>\n

In many instances, these apps are completely harmless and often serve as a valuable business tool. In other instances, these apps can act as malware, similar to an executable file.<\/p>\n

\n\"Figure\n<\/picture>
Figure 3. Connecting third-party apps.<\/figcaption><\/figure>\n

The Next Evolution: An Attack Method Through SaaS<\/h2>\n

With this SaaS rootkit, threat actors can create malware that lives as a SaaS app and can infiltrate and maintain access to a user’s account<\/a> while going unnoticed.<\/p>\n

While bad actors can’t find Exchange Legacy scopes that can used to add programmatically online hidden forwarding in the Microsoft UI, they can add them through a terminal script.<\/p>\n

The attacker’s job is simple: Create an app that looks credible, add the legacy scope protocols removed from the UI to the app (exploiting the vulnerability that the Adaptive Shield team uncovered), and send an offer to users to connect to it. The user will see an OAuth app dialogue box on the official Microsoft site, and many will likely accept it (Figure 4).<\/p>\n

\n\"Figure\n<\/picture>
Figure 4. This screen shows a fake app permissions request.<\/figcaption><\/figure>\n

Once a user accepts, the bad actor receives a token that grants permission to create forwarding rules and hides them from the user interface like a rootkit.<\/p>\n

An attack through these hidden forwarding rules should not be mistaken for a one-off attack but, rather, the start of a new attack method through SaaS apps.<\/p>\n

Microsoft Response<\/h2>\n

In 2022, Adaptive Shield contacted Microsoft about the issue, Microsoft in response said that the issue has been flagged for future review by the product team as an opportunity to improve the security of the affected product.<\/p>\n

How to Best Mitigate a SaaS Rootkit Attack<\/h2>\n

There’s no bulletproof way to eliminate SaaS rootkit attacks but there are a few best practices that can help keep organizations more protected.<\/p>\n