The issue appears to be that OneDrive has an app that is installed on Windows devices which looks like a folder, that users can access locally through the file explorer, just like any other folder. The app also automatically synchronizes all of the files stored in that folder with its counterpart in the cloud.
Pulling session tokens
The app also stores all of the user logs in a single directory. These logs hold session tokens that Yair was able to pull out of OneDrive’s directories and create junctions that lead to areas outside OneDrive’s own directory. In other words, he gained access to files stored locally on the target endpoint.
From that point, all it took to wrap the attack up was to encrypt the files. Even those stored in OneDrive, which act as a shadow backup, were deleted, thanks to a flaw found in the OneDrive Android app. Once the app is done, all the victim has are encrypted backups of encrypted files.
To add insult to injury - most endpoint detection and response tools (EDR) couldn’t spot the benevolent app going rogue. And given that there was no malicious code added anywhere, they couldn’t flag it as ransomware, or malware, either. The researchers are saying that CyberReason, Microsoft Defender for Endpoint, CrowdStrike Falcon, and Palo Alto Cortex XDR all failed the test. SentinelOne’s program caught the attack but didn’t stop it because OneDrive was added to its allow list.
To address the issue, Microsoft has already released a patch, and the abovementioned cybersecurity companies all patched their EDRs.
The good news is that in order to pull the attack off, the threat actor needs to have access to the target device in advance. So, just make sure you don’t infect your devices with any malware, and you’ll be just fine.
- Here's our rundown of the best endpoint protection tools
Via: The Register
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.