{
  "guid": "5a7f47a6-3f4f-5496-8d05-f9b229aad0fc",
  "id": 281,
  "date": "2024-12-30T11:00:00+01:00",
  "start": "11:00",
  "duration": "00:40",
  "room": "Saal 1",
  "slug": "38c3-from-simulation-to-tenant-takeover",
  "url": "https://events.ccc.de/congress/2024/hub/de/event/from-simulation-to-tenant-takeover/",
  "title": "From Simulation to Tenant Takeover",
  "subtitle": null,
  "language": "en",
  "track": "Security",
  "type": "Talk",
  "abstract": "All I wanted was for Microsoft to deliver my phishing simulation. This journey took me from discovering trivial vulnerabilities in Microsoft's Attack Simulation platform, to a Chinese company to which Microsoft outsourced its support department that wanted all my access tokens. I finally ended up hijacking remote PowerShell sessions and obtaining all data from random Microsoft 365 tenants, all the while reeling in bug bounties along the way.",
  "description": "This talk is the result of what happens when you ask a hacker to simply automate sending out a phishing simulation.\r\n\r\nMy first attempt with Microsoft's new Attack Simulation platform resulted in three bug bounties for the most trivial vulnerabilities and no more faith in the product. \r\n\r\nThen I tried building a phishing simulation program myself and the last thing I needed was to allowlist my IP address in Exchange Online. \r\n\r\nI ended up in a rabbit hole where I discovered that Microsoft outsourced their support department to a Chinese company that wanted all my access tokens. \r\n\r\nI then tried intercepting client-side requests made by the Security & Compliance center with the goal of replaying these to a backend API, only to discover that by fiddling with some parameters I could now hijack remote PowerShell sessions and access Microsoft 365 tenants that were not mine. Tenants where I could now export everything, e-mail, files, etc.",
  "logo": null,
  "persons": [
    {
      "guid": "8c326269-334c-5767-91c5-f66d2f903f07",
      "name": "Vaisha Bernard",
      "public_name": "Vaisha Bernard",
      "avatar": "https://fahrplan.events.ccc.de/congress/2024/fahrplan/media/avatars/vaisha_blackwhite_McIai0E.jpg",
      "biography": null,
      "url": "https://events.ccc.de/congress/2024/hub/de/user/speaker_8c326269-334c-5767-91c5-f66d2f903f07/"
    }
  ],
  "links": [],
  "origin_url": "https://fahrplan.events.ccc.de/congress/2024/fahrplan/talk/MCGKUA/",
  "feedback_url": "https://fahrplan.events.ccc.de/congress/2024/fahrplan/talk/MCGKUA/feedback/"
}