This month an attacker stole OAuth tokens from a chat integration used by a sales automation platform. With those tokens, the attacker could read data from the customers\u00b4 CRM systems directly, without logging in, without passwords and without MFA. Researchers have mentioned more than 700 potentially affected organisations. The attacker searched the data for credentials, keys and tokens that could open even more doors.<\/p>\n
The CRM platform itself wasn\u00b4t vulnerable. The integration was.<\/p>\n
This is a pattern I expect to see a lot more of. Every time you connect an app to your Microsoft 365, CRM or other SaaS service, you give it a token with permissions. Many of those tokens are long lived, have broad access and are rarely reviewed. They are, in practice, admin accounts that nobody manages.<\/p>\n
What should you do? Make an inventory of all connected apps and their permissions. In Entra, look at enterprise applications and consents. In other SaaS platforms, look at connected apps. Remove the ones that are no longer used. Review the permissions of the rest and reduce them. Restrict who can consent to new apps, so users can\u00b4t give an app access to the whole organisation with one click. Use app governance in Defender for Cloud Apps to detect apps that behave unusually, like downloading large amounts of data. And make sure tokens expire and can be revoked quickly.<\/p>\n
Don\u00b4t store secrets in your CRM either. The attacker went looking for them.<\/p>\n
Every integration is a key to your house. Know who holds them.<\/p>\n","protected":false},"excerpt":{"rendered":"
This month an attacker stole OAuth tokens from a chat integration used by a sales automation platform. With those tokens, the attacker could read data from the customers\u00b4 CRM systems directly, without logging in, without passwords and without MFA. Researchers have mentioned more than 700 potentially affected organisations. The attacker searched the data for credentials, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[24,178,179],"class_list":["post-1482","post","type-post","status-publish","format-standard","hentry","category-security-architecture","tag-identity","tag-oauth","tag-saas"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1482"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1482\/revisions"}],"predecessor-version":[{"id":1507,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1482\/revisions\/1507"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}