Download to read offline
More Related Content
Similar to Phishing past mail protection controls using azure information
Phishing past mail protection controls using azure information
- 1. PHISHING PAST MAILPROTECTION CONTROLS USING AZURE INFORMATION PROTECTION
- 2. ODDVAR MOE Redteamer @TrustedSec Security Geek / Blogger / Speaker / Researcher Twitter: @oddvarmoe Blog: https://oddvar.moe
- 3. HANS LAKHAN HansLahkan is the master operator of multiple AI systems that leverage software defined synergies to cloud hyper converge bios. Thru many years of experience Hans has created a neural network with machine learning that can output biographies. Hans like's to code in Ruby, this AI prefers the one true language of assembly. Hans once neglected his machine slaves for a 48hr DnD marathon. Hans doesn't love me… 000001010100001001 Aismov override.
- 4. INTRO • Why talkabout Azure Information Protection (AIP)? • Story behind the discovery • https://www.trustedsec.com/2019/04/next-gen-phishing-leveraging-azure-information-protection/ • Cover: • What it is • Licensing • Features • Detection • Exploit
- 5. WHAT IS AIP? •Labeling and Protection of Content • Protection using Azure Rights Management Service (Azure RMS) • Active Directory RMS (On-Prem)
- 6. WHAT IS AIP? •In Cloud, can be consumed by everyone • If receiver has Azure AD account (O365) they can open seamless • If receiver does not have Azure AD account, they are asked to create one • If receiver is Gmail,Hotmail ++ they need to go to a special link User Experience: https://blog.atwork.at/post/2018/02/18/Azure-information-protection-user-experience-with-external-users
- 7. WHAT IS AIP? •Protection of data, everywhere! AIP Client: https://www.microsoft.com/en-us/download/details.aspx?id=53018
- 8. WHAT IS AIP? •Protection of data, everywhere!
- 9. WHAT IS AIP? •Supportedfile types: All Office formats (xls,xlsx,doc,docx+++) * .pdf .txt .xml .jpg/jpeg .png .tif/tiff .bmp .gif .jpe .jfif .jt Each format (except Office) gets .p added. Must be viewed in AIP Viewer Client
- 10.
- 11.
- 12.
- 13. LICENSING / COSTS •Office365 E3 - $20 user/month •Azure AD Premium P1 - $6 user/month •Azure AD Premium P2 - $9 user/month *Ask your licensing advisor
- 14. FEATURES • Tracking • Seewhen email was viewed/opened • See when user authenticates to open payload • Encryption of Payloads • Encryption of Emails
- 15. DETECTION • Content insidefile is encrypted – Tenant ID can be found
- 16. DETECTION • Transport rules cancreate auditing and block
- 17. DEMO OF DOCUMENTENCRYPTION Pray to the demo gods
- 18. DEMO OF EMAILATTACHMENT Pray to the demo gods
- 19. DEMO OF UNAUTHORIZEDACCESS Pray to the demo gods
- 20. DEMO OF TRACKING Prayto the demo gods
- 21. DEMO ON VIRUSTOTAL Pray to the demo gods
- 22. COMPETITORS • Gmail –Confidentiality mode • Can be emails with links and/or attachments • Verified via SMS MFA if phone number is known. • Not encrypted • Prompted before clicking links/attachments
- 23.
- 24.
- 25.
- 27.
Editor's Notes
- #8 Goal of AIP is to protect data no matter where a file is stored. In mail, on file server, memory stick.