A SCARY phishing Attack (And how to clean it up!) using Office 365. скачать в хорошем качестве

A SCARY phishing Attack (And how to clean it up!) using Office 365.

Email phishing attacks are scary, and it can sometimes be hard to defend against and to clean up.  And this Office 365 SSO attack using Microsoft own solutions is one of them.   As a sysadmin, the best thing is to prevent this from happening in the first place. You do this by setting a policy in Azure Active Directory preventing users from granting access to untrusted applications.   But if any of your users get phished by this technique, be aware that it is not sufficient to reset password and revoke all user sessions. The stolen tokens can still be used by applications integrated with AAD until they expire! So what you can do in the meantime is: 1. Disable the user. 2. Wait for 60 minutes for the JWT token to time out (60 minutes is the default value and could be different depending on configuration and the destination application itself). Hey.. We are hiring! https://career.truesec.com/