Microsoft 365 exploit could give attackers access to all your emails
Power Automate could be leveraged to exfiltrate data, researchers claim
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Researchers have uncovered a new way to abuse a workflow automation feature inMicrosoft 365to exfiltrate data.
Eric Saraga from cybersecurity firm Varonis discovered how Power Automate, a feature found inMicrosoft365 for Outlook, SharePoint, and OneDrive, can be abused to automatically share or send files, or forwardemails, to unauthorized third parties. Not in the fashion ofransomware, but devastating nonetheless.
The premise is simple: Power Automate, a feature that is enabled by default with Microsoft 365 applications, allows users to create their own “flows” - automated cross-app behaviors. To set these behaviors up, the user must first create a connection between two apps, allowing data to flow between the two.
Faking an Azure app
In a fashion similar to forwarding emails, Saraga explains, these flows can be used to extract emails, as well as files from SharePoint and One drive. There is even the possibility to exfiltrate data from other Microsoft 365 applications, including MSGraph, he added.
Saraga also explains two methods with which flows can be abused: one is by having direct access to the victim’s endpoint, while the other one requires tricking the victim into downloading a fake Azure application.
The first method is somewhat harder to pull off, but is also more devastating.
“Creating flows can be done programmatically using the flow API. Although there’s no dedicated Power Automate API, the flow endpoints can be used to query for existing connections and to create a flow,” he explains.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Azure App Service flaw exposes huge collection of source code repositories>Microsoft fixes major Azure security flaw>Microsoft Azure security flaw left thousands of cloud databases vulnerable to hackers
“Once a Microsoft 365 account is compromised, attackers can simply execute a command that will leak sensitive data coming in, without the need to manually create the Power Automate flow.”
The second method - tricking the victim into downloading the app - comes with a caveat. Once the user consents to running themalwareapp, it will have the necessary permissions to create a flow. However, there is no way to create a new connection using the app. The attacker can onl use existing connections, meaning Azure applications for this attack limit the malicious actors to users who have already made certain connections.
“The more fool-proof method would be to use the user’s credentials or a Power Automate authentication token,” he concludes.
One of the ways to mitigate the threat, Saraga explains, is to monitor for behaviors.
“Behavior-based alerts are also extremely effective at detecting when a user is infected with malware that is operating under the user’s context—it’s very hard for attackers to emulate a user’s normal day-to-day behavior,” he concluded.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
7 myths about email security everyone should stop believing
Best Usenet client of 2024
How to turn off Meta AI
