#RomHack2022 - Nestori Syynimaa - Attacking AAD abusing Synch API: The story behind 40k$ bounties
Demonstrates #RomHack2022 - Nestori Syynimaa - Attacking AAD abusing Synch API: The story behind 40k$ bounties and evaluates key implications for security practitioners.
Summary
AAD Connect sync basics
Nestori Syynimaa (creator of AADInternals, also referenced in APT29/Nobelium reporting) explains Azure AD Connect directory synchronization for hybrid identity, including powerful on-prem and cloud service accounts and password-hash replication secrets.
Credential extraction
Using AADInternals on a compromised Connect server, he demonstrates extracting stored sync credentials from the local database and reusing them remotely when protections are weak—a common real-world gap.
Reverse engineering the sync protocol
Research uses Fiddler man-in-the-middle on Connect's SOAP plus binary XML traffic. He fixed a missing dictionary entry in an existing Fiddler plugin, enabling readable messages. Connect can CRUD synchronized cloud objects keyed by immutable ID or cloud anchor.
Bug bounty war stories
He previews two abuse chains against the sync API, including vendor fixes and his evasions, tied to substantial bug bounty payouts beyond his day job.
Related talks
Village Interviews·< 1 min
A quick spotlight on the Bug Bounty Village highlighting collaborative hunting events, live hacking, and educational sessions at DEF CON 34.
CSIT Village·22 min
Poh Cai Min · Shawn Pang
Poh Cai Min and Shawn Pang examines grammar-based fuzzing made painless.
CSIT Village·17 min
Daryl Lim · Zhi Kai
Daryl Lim and Zhi Kai examines a thought experiment on Rolling API Tokens, leveraging the Double Ratchet Protocol to eliminate long-lived secrets through continuous key rotation.