Exploiting Token-Based Authentication: Attacking and Defending Identities in the 2020s.

Overview Dr. Nima, Principal Identity Security Researcher at Microsoft's Threat Intelligence Center, delivered a comprehensive talk on exploiting token-based authentication systems. The presentation covers both historical context and modern federated identity architectures, demonstrating practical attacks and defensive techniques.

Evolution of Authentication Models The talk contrasts two paradigms: the legacy silo model where users authenticate directly to each service (creating multiple credentials and single points of failure), and the modern federated model where a centralized Identity Provider (IDP) issues tokens for use across multiple Service Providers. The federated approach reduces risk by isolating identity credentials from individual service providers.

Authentication Protocols and Token Types The speaker traces three major federated protocols: Kerberos (since 1989), SAML (2002), and OAuth 2.0/OpenID Connect (2007). Modern implementations typically use JWT (JSON Web Tokens) consisting of header, payload (claims), and signature. Entra ID uses ID tokens and access tokens (1-hour lifetime) and refresh tokens (90-day lifetime). Bearer tokens are credentials where possession alone proves identity without requiring cryptographic proof of possession.

Attack Taxonomy The speaker presents a two-pronged attack model: (1) stealing tokens directly from users or systems, or (2) stealing signing secrets from IDPs to forge fraudulent tokens. Attacks map to MITRE ATT&CK techniques including T1552.04 (unsecured credential storage for private keys), T1528 (steal web credentials), and T1550.001 (access token manipulation). Stealing secrets enables longer-term, broader attacks (impersonating any user), while token theft provides temporary access bounded by token lifetime.

Live Demonstrations The speaker demonstrated extracting JWT access tokens from browser developer tools (F12) and using them to query Microsoft Graph API endpoints. Additional demos showed: (1) forging Kerberos service tickets using stolen domain controller secrets, (2) creating fraudulent SAML tokens by signing them with stolen certificates, and (3) extracting claims from ID tokens using online JWT decoders. The speaker's custom PowerShell toolkit enabled complete exploitation workflows.

Real-World Case Study: Storm-0558 The April-July 2023 attack by Chinese threat actor Storm-0558 exemplifies the severity of secret theft. The actors compromised an expired Microsoft account token signing key and exploited an Exchange Online misconfiguration to access emails from approximately 25 organizations. The attack was detected through careful correlation: activity appeared in Exchange Online unified audit logs with no corresponding Entra ID signing events, indicating token forgery.

Detection Strategies Effective detection requires coordination across multiple log sources. For hybrid identity environments: correlate on-premises domain controller logon events with ADFS audit logs and Entra ID signing logs—any resource access requires corresponding authentication events. For cloud-only identity: monitor for Entra ID signing events with no corresponding user authentication, indicating forged tokens. IP validation: extract and compare IP addresses from ID/access tokens against actual request source IPs in application logs. The speaker demonstrated custom code comparing token IP claims with request IPs to detect token theft, though this requires custom application instrumentation. Optional claims (IP address, user agent) added to tokens enable forensic comparison.

Prevention Measures Layered defenses include: (1) harden IDP components to Tier 0 status, (2) use custom certificates and Hardware Security Modules (HSM) for private key storage, (3) enforce zero trust policies restricting access to managed, compliant devices only, (4) implement token binding (emerging technology) to cryptographically bind tokens to client devices, and (5) enable Continuous Access Evaluation for real-time revocation. Zero trust prevents token theft by limiting access to corporate resources only from managed endpoints.

Emerging Technologies Token binding and Continuous Access Evaluation represent protocol-level improvements not yet universally standardized, aiming to prevent token use outside legitimate contexts. The speaker noted these are technical advancements but lack universal standards.

Takeaways Token-based authentication security depends on protecting secrets (stored in HSM, access-restricted) and tokens (encrypted in transit, validated on use). Defending against sophisticated adversaries requires correlating authentication logs across endpoints, IDPs, and service providers. The Storm-0558 case demonstrates that even major organizations can suffer token signing key compromise; detection through log correlation proved critical. The speaker emphasized this is a team sport requiring both infrastructure hardening by administrators and custom detection mechanisms from developers.