Microsoft OneDrive could pose a serious security threat to your business, according to new research from
Presenting at the recent Black Hat conference, SafeBreach expert Or Yair demonstrated how threat actors could leverage the cloud storage platform for a ransomware attack.
The issue appears to be that OneDrive has an app that is installed on Windows devices which looks like a folder, that users can access locally through the file explorer, just like any other folder. The app also automatically synchronizes all of the files stored in that folder with its counterpart in the cloud.
Pulling session tokens
The app also stores all of the user logs in a single directory. These logs hold session tokens that Yair was able to pull out of OneDrive’s directories and create junctions that lead to areas outside OneDrive’s own directory. In other words, he gained access to files stored locally on the target endpoint.
From that point, all it took to wrap the attack up was to encrypt the files. Even those stored in OneDrive, which act as a shadow backup, were deleted, thanks to a flaw found in the OneDrive Android app. Once the app is done, all the victim has are encrypted backups of encrypted files.
To add insult to injury – most endpoint detection and response tools (EDR) couldn’t spot the benevolent app going rogue. And given that there was no malicious code added anywhere, they couldn’t flag it as ransomware, or malware, either. The researchers are saying that CyberReason, Microsoft Defender for Endpoint, CrowdStrike Falcon, and Palo Alto Cortex XDR all failed the test. SentinelOne’s program caught the attack but didn’t stop it because OneDrive was added to its allow list.
To address the issue, Microsoft has already released a patch, and the abovementioned cybersecurity companies all patched their EDRs.
The good news is that in order to pull the attack off, the threat actor needs to have access to the target device in advance. So, just make sure you don’t infect your devices with any malware, and you’ll be just fine.
Via: The Register
