Onsdag – 5 · Kulturhuset Banken, Expedisjon
Security Specialist - Binary Security
Torjus works as a security specialist in Binary Security. He has nine years of experience working with technical information security. Currently he focuses on security testing and security engineering, mainly with applications and cloud infrastructure.
What if a low-privileged user in Azure could change their own User Principal Name (UPN)—essentially rewriting their identity in the cloud?
In this talk I’ll describe how I by accident found a simple vulnerability in Azure and Entra ID that allowed any low privileged user to change their own UPN, leading to privilege escalations in Azure, identity spoofing, user account takeovers in third party applications and other security implications. I will present how the vulnerability could be exploited, and how it could affect organizations.
This talk will highlight the fragility of cloud identity management systems, and vulnerabilities that can undermine trust in a whole ecosystem.
Programmet er oppdatert.