Exploiting Token Based Authentication

The talk opens with a refresher on how web authentication has developed, from HTTP authentication schemes to federated single sign-on. It compares Kerberos tickets, SAML assertions and OAuth-style access tokens used with Microsoft Entra ID, including hybrid setups where an on-premises AD FS server vouches for users. The speaker frames the core risk: a bearer token lets whoever holds it act as the user, no matter how strong the original sign-in was.

The middle section covers two attack paths. The first is stealing secrets from the identity provider, such as the AD FS token-signing certificate, which makes it possible to mint tokens that satisfy MFA and conditional access. The second is stealing tokens from a user's managed device, including primary refresh tokens and session keys, which can then be used to request access tokens while presenting a trusted device identity. Live demonstrations walk through both chains. For detection, the speaker recommends correlating identity provider sign-in logs with service-side usage logs, checking unique token identifiers, and comparing the IP address recorded in a token with the address that requested it.

The closing part covers prevention: hardening the identity provider, removing local admin rights from users, and using Entra token protection and continuous access evaluation. These controls reduce the risk but are not complete fixes. The talk ends by discussing a 2023 incident involving an expired consumer signing key and summarises that stolen tokens give temporary access, while stolen secrets give persistent access as any user.