Full transcript
0:00How do you know when you've had a
0:01security incident? How does your team
0:03know when you're compromised? Well,
0:05usually your endpoint detection response
0:08solution or your antivirus flags an
0:11alert because it saw something happened
0:13or there were some logs thrown into your
0:15SIM or your SEAM solution and there was
0:17visibility to detect a threat. But, what
0:20about attacks where there aren't a lot
0:22of options to have that visibility? What
0:25about where your EDR and antivirus can't
0:28see it? Now, throughout the past year or
0:31so, we've talked a lot about ClickFix,
0:34this attack technique that is social
0:36engineering, ultimately, tricking the
0:38end user to go through just regular
0:40steps or instructions that they're
0:42pretty desensitized to, like a Google
0:45form or this reCAPTCHA checkbox that
0:47says, "I'm not a robot." But, then
0:49you're presented with these
0:50instructions. Now, you think about this,
0:53this is behind the firewall, right? We
0:55paste in a payload and then, uh-oh,
0:58we're hacked. That's tricking the end
1:00user to run malware or detonate a
1:03payload on their own. And the industry
1:05has seen this ClickFix technique grow
1:07and change over time and evolve into
1:10different variations where, oh, it's
1:12like a cookie consent banner or an HTTPS
1:15certificate that's not signed, needs you
1:17to click next to continue or something
1:19like, oh, a Windows update screen. There
1:22were alternatives for the hot keys, like
1:24rather than Windows key and R, you could
1:25use something like Windows key and X and
1:27then press I or T to open up a terminal.
1:30There was an adaptation called FileFix
1:33where you press the Windows key and E to
1:35open the file explorer and then run a
1:36command right from the address bar.
1:39There was TerminalFix, there was
1:40DownloadFix, there were all these
1:42prefixes that we kept adding to fix.
1:44But, in its purest form, when ClickFix
1:47was first seen in the wild, analysts and
1:49incident responders were like, "Where
1:51did this come from?" This powershell.exe
1:54process seemed to come out of nowhere.
1:56Eventually, you could find and detect,
1:58oh, that was a child process of
1:59explorer.exe.
2:01So, this left behind some artifacts and
2:03telemetry on the endpoint. Like, we
2:06could open up registry, take a look at
2:08our registry editor here, and the run
2:10MRU field would see the artifact that
2:13actually triggered here. All this to
2:15say, ClickFix is an endpoint technique
2:18that could trigger and run
2:19endpoint-based malware. Think of like a
2:22crypto miner, or think of ransomware, or
2:25think of infostealer malware. Now,
2:27infostealer malware is interesting
2:29because with that, that technique,
2:30threat actors, hackers, and
2:32cybercriminals are getting your
2:33passwords and credentials, and they
2:35could then use that with a web browser
2:38to find your online identities. And we
2:40have sort of two separate attack
2:42surfaces. There's the endpoint, the
2:44traditional computer itself, and then
2:46there's your identity, who you are and
2:48how you access your accounts. So, what
2:51we knew as ClickFix traditionally
2:53targeted the endpoint attack surface.
2:56But, up until the fine folks over at
2:59Push Security saw this thing in the
3:01wild, ConsentFix.
3:03Now, Push Security sits in a really
3:05interesting place because they are doing
3:08security for the web browser. That kind
3:10of blurry boundary between, sure,
3:13endpoint attacks and identity attacks.
3:16And the ConsentFix attack technique fits
3:19squarely in the browser. So, there
3:22aren't any breadcrumbs or artifacts left
3:24behind EDR could usually track down.
3:27Quick crash course, what it does is
3:29leveraging the natural, native,
3:31legitimate, actual first-party Microsoft
3:34capability and tool for the Azure
3:37command line utility that operates as an
3:39OAuth app, so that it could be
3:41authenticated into your Microsoft Entra
3:45ID or Azure Active Directory online
3:48tenant. Think of a Cloudflare turnstile,
3:50right? Looks a lot like a Google
3:52reCAPTCHA as we've seen, but rather than
3:54just a checkbox oh, I'm not a robot, it
3:57asks for your email address and then it
3:59has you actually copy and paste the
4:02local host sign-in code to authenticate
4:06an OAuth app. That code that's included,
4:09that little HTTP parameter for a local
4:12host redirect callback for registering
4:15and authenticating this OAuth app is
4:17honestly all that an attacker might need
4:20to have the keys to the kingdom. And it
4:22seemed like this is an identity-based
4:25click fix technique. Now, in the past, I
4:27got completely nerd sniped by this and I
4:30made a little video showcasing it. You
4:31might have seen that consent fix video
4:34here. I even got to hang out with Push
4:35Security in a little webinar live stream
4:37to talk about this. Oh, and by the way,
4:39they do have a couple more sessions of
4:40these with super cool folks, much cooler
4:43than me. They've got Troy Hunt, the
4:44creator of the Have I Been Pwned
4:45database. You've got Mat Johansson,
4:47founder over at Vulnerable U. And if you
4:49wanted to catch mine, that has already
4:51passed, but you could catch the
4:51recording. But I really wanted to chat
4:53with them about consent fix because they
4:55have this unique perspective seeing this
4:57attack chain that occurs wholly only in
5:00the browser, no other EDR artifacts to
5:03it. And I had to say, "Look, I got to be
5:05honest, I'm not seeing a lot of this. I
5:07haven't seen it hit the streets, but
5:09that's also due to the fact that there
5:11are things that I don't have visibility
5:13over." So, I started to wonder, "Are
5:15threat actors talking about this? Are
5:17actual cybercriminals already hot on
5:19this consent fix topic?" Turns out,
5:21they're chatting about it. I took a look
5:24within Flare. Now, if you're not
5:26familiar, Flare tracks activity on the
5:28dark web. And it's not just the dark
5:30web, they do the clearnet, too, but
5:31think of like Tor hidden services or dot
5:34onion sites. Think of illicit like
5:36cybercrime marketplaces or forums or
5:39bulletin boards or ransomware leak sites
5:41or data breaches or infostealer malware
5:43logs, all this stuff that Flare has some
5:46incredible and insane visibility into
5:48and threat intelligence for. Also, that
5:50you could track down, find your exposed
5:54attack surface for yourself, for your
5:56team, for your employees, your
5:57co-workers, even your family. Trying to
5:59see are any of your credentials out and
6:01about? I have some stuff set up for like
6:02my name, if there's ever any mention of
6:04what I'm up to, or if you wanted to sync
6:06this to your Entra ID tenant, you
6:07totally could. So, whenever passwords or
6:09credentials or cookies are exposed,
6:12leaked, and out and about on the public
6:13internet, you can be notified with any
6:15alerts you can configure. You can build
6:17these all up for your specific tenant,
6:19but an amazing side effect is that you
6:21could basically use the global search to
6:23look through all of Flare siphoned up
6:25data and telemetry to essentially have
6:27like Google or this incredible search
6:29engine for the dark web and everything
6:31that Flare is tracking across all of
6:33these categories. Telegram chats,
6:36financial data, infected devices, of
6:38course the open web. There's so much
6:40stuff here. So, let me search for simple
6:43consent fix. I'll let enter on that and
6:46we'll see just about, okay, 49 events.
6:48Take a look at the results here. We've
6:50got one hit on XSS, a well-known
6:53cybercrime forum. That's very recent,
6:55April 21st. Going back in time, looking
6:57at April 9th, maybe someone re-sharing
6:59some malware news articles, some folks
7:02talking about this on Telegram, other
7:04forums. Looks like March 2nd was a
7:07previous hit for that XSS post. Kind of
7:09wild to go back in time to see folks
7:12chatting about this. This goes all the
7:13way back to the very beginning of when
7:16Push Security kind of spread the word on
7:17this thing, December 11th. But, in
7:20March, the XSS post kind of caught my
7:23eye cuz they say "Consent fix V3, the
7:26ultimate Azure attack chain, OAuth 2
7:28abuse, two-factor authentication bypass,
7:30token exfiltration automated with Pipe
7:32Dream, zero cost." So, I thought, "Ooh,
7:35I want to go take a look at that." And I
7:37grabbed the URL. All right, this is that
7:39URL and I'll read through this page in
7:41just a second. But, I did want to shine
7:44one more spotlight on Flare because,
7:46goodness gracious, it is too cool. They
7:48have over a billion events, new data
7:50that they're collecting, over 5 million
7:52info-stealer malware logs, chat messages
7:54from Telegram, and this is just like the
7:56last 3 months. I can take a look at the
7:58collection page here, looking at all
8:00their data from all time. It is insane
8:03to see the amount of info and insight
8:05that they have and that can be used to
8:07protect you and your organization.
8:09They're tracking name data breaches,
8:10tons of different Telegram channels, and
8:12you could, of course, have it generate
8:13different threat intelligence reports
8:15for your industry, sector, and vertical.
8:18Maybe some supply chain risks from
8:19downstream ransomware or even looking
8:21out for any credentials that are
8:23exposed. And, if you hook that up to
8:25your Entra ID environment, any of those
8:27susceptible or compromised accounts can
8:29be locked down, remediated, saved in
8:31just a couple seconds. Look, you know,
8:33I'm a huge fanboy of Flare. They have
8:35incredible research, incredible insight,
8:36incredible data, and I really appreciate
8:39them and their support. They are the
8:40sponsor of this video, so thank you for
8:42supporting the channel and all of my
8:44endeavors and everything that I'm up to.
8:45So, big shout out, big thanks. Hope you
8:47do give some love to Flare, link below
8:49in the video description. So, this user
8:52shared a full-on article on how to
8:55perform the consent fix attack, what
8:57they're calling V3, because they're
8:59using just some easily available, anyone
9:03could access online accounts or
9:05infrastructure. They even include a
9:07video that we'll play in just a moment,
9:09but I think this is kind of wild because
9:11it's literally a playbook. It's
9:14literally an explanation. It's kind of a
9:16walk-through of their tradecraft, the
9:18tools that you could use, go log in, ads
9:20power, pipe dream, doc sign, Cloudflare,
9:22how they deploy their phishing page, how
9:25they set up some hooks in between them,
9:27how they harvest emails and determine
9:29what they could use for their email or
9:31their lure, and anything and everything
9:33to be able to perform this technique.
9:36This is literally written like a
9:38tutorial. They go through and explain
9:40the history. They talk through each and
9:42every concept. They discuss how this all
9:44came together in the timeline. They
9:47include their screenshots. They walk
9:49through each and every part and piece of
9:51this. I don't know if you can see my
9:52vertical scroll bar here, um but there's
9:54a lot more to this. We use a temporary
9:57account to register on GoLogin, grab the
9:59free residential proxy credentials, plug
10:01them into AdsPower profiles. Like this
10:03is literally a bible on how this could
10:06be put together. And I think this is
10:08fascinating for two reasons. One,
10:10because okay, we have sure, a
10:12cybercriminal sharing with their
10:14friends, telling everybody, "Hey, here's
10:16how to do this thing easy peasy for
10:18free." And it's also really wild because
10:21okay, from a defender's point of view,
10:22now we're seeing exactly the kinds of
10:24services that they're using and abusing,
10:26which could very well be legitimate,
10:28hey, general purpose, actual
10:30well-intended services, but that's the
10:32living off trusted sites technique,
10:35right? That's when our ill-intended
10:37actor leverages services that are
10:39already out there, and this entire
10:41article is showcasing how you can do
10:43that for this entire attack technique.
10:46They even give you code. This
10:48documentation may very well be better
10:51than the documentation you have in your
10:53own organization. I can't scroll through
10:56this entire thing for us, but like let
10:58me zoom out just so you can see how
11:00insane this is. Go to bring this all the
11:02way to Okay, I can't even fit it in 25%.
11:07Scrolling back up, starting from the
11:08top. This is it. Absolutely insane. So,
11:12let's take a look at the threat actor
11:15and cybercriminal video demo they
11:17provided here. I'm going to shield you
11:19from the weird techno rap song they're
11:21playing in the background, and I'll full
11:22screen this for us. Remember, this is a
11:24video from a cybercriminal. So, we'll
11:26take that with a grain of salt, but it
11:28looks like they're staging a fishing
11:30email with Tutanota, and then they're
11:32using Dropbox DocSend to prepare at
11:36least a formal online link to be able to
11:39provide this PDF file that they'll use
11:41as their lure. But, keep in mind, this
11:43doesn't need to be a fish or social
11:46engineering technique that just lands in
11:48your inbox because that consent fix
11:50attack could just be somewhere out on
11:52any website or like a compromised site.
11:55It's interesting they're adding password
11:56protection to that document. For one
11:58thing, antivirus can't scan it if it
12:00were to be downloaded, but because it's
12:02sent over Dropbox and DocSend, you have
12:05a fake semblance of security where oh,
12:07it looks like it's protected because
12:09there's a password on there. It's got to
12:11be legitimate. But, that's been sent
12:13with TutaNota, Dropbox and DocSend to
12:16attach the file, and now the user could
12:19open that up, fill in that password, and
12:21then be presented with just a link, like
12:23a domain verification link to see how
12:26this is hosted on a Cloudflare worker
12:28domain. You can see the Cloudflare pages
12:30or the dotworkers.dev
12:32URL at the very top. And then, consent
12:34fix in action here. Say that you they
12:37were to sign into their account, and
12:38they just moved or copy and pasted or
12:41drag and dropped the special code so
12:44that localhost redirect, they could just
12:46drag in that copied URL,
12:49and now they have redirected back into
12:52their environment. But, from the threat
12:54actor's point of view, they have now an
12:57event entry in their PipeDream webhook
12:59logs that shows all of the access, the
13:02full URL that was sent, and any of the
13:04tokens that could come with it. You can
13:06see their refresh token, you can see
13:08their auth code, their access token, and
13:11those are the keys to the kingdom to now
13:13just break into that victim's Entra ID
13:16environment. And they're managing this
13:18with their own little dashboard. I
13:19believe this is Specter portal that they
13:21might have referenced. I haven't seen
13:23that live on GitHub, but with that, now
13:25they could do further post-exploitation.
13:28They're inside of your Entra ID
13:29environment. So they could move around.
13:32They could go try and see, "Hey, we'll
13:33break into your email on Outlook. We'll
13:36go explore your OneDrive or SharePoint
13:39documents." Or they'll send messages to
13:41other members in Teams. They could do
13:43more post-exploitation and move
13:46throughout the environment, whatever
13:47damage they want to do at that point.
13:49But look, I thought that was kind of
13:51bonkers. Like straight from the horse's
13:53mouth. Hey everybody, here's how to do
13:55this. Here's how to do it completely for
13:57free. Here's a video, here's code,
13:59here's a straight-up tutorial. And
14:01you've got other threat actors chirping
14:03about this thing. Here's a response.
14:05Hey, excellent article, really well
14:06explained. They say, "Thanks so much.
14:08There's another one in the works,
14:09Windows stealer." Ah.
14:12So hey, I want to wrap this up, kind of
14:14taking a page from the hacker's playbook
14:16here, right? The future of consent fix,
14:18again, they go through a little bit of
14:20why this is kind of wild. First-party
14:22apps are permanently trusted, browser is
14:24the battleground now, and those endpoint
14:26defenses like EDR and antivirus won't
14:30see it. That's why I really want to hang
14:31out with Push Security on this to chat a
14:33little bit more about it. And because
14:35look, there's not easy visibility. You
14:37got to be sitting in your browser to
14:39kind of understand this. And I think it
14:41is going to keep cruising. The same way
14:43we saw click fix evolve, the same way we
14:44saw threat actors chatting about that, I
14:46think we're doing the same for consent
14:48fix, and we'll see where this goes. But
14:50that is why I do think it's worth it to
14:52stay ahead of the threat, know what the
14:54threat actors are up to. And hey, Flare
14:56gives some sweet visibility that, too.