TrustSink: How a Rogue External MFA Provider Steals Passwords
Learn how TrustSink abuses rogue Entra external authentication providers to capture passwords and why removing the provider matters after a reset.
TrustSink is a technique that transforms a malicious external Multi-Factor Authentication (MFA) provider into a persistent credential trap. This occurs when an attacker with high privileges registers a rogue External Authentication Method (EAM) and inserts a deceptive password page into the authentic sign-in process. The page captures passwords in plain text, while the provider returns a valid signed token, allowing the login to complete seamlessly.
Our research, conducted by Varonis Threat Labs, showcases how this technique works using Microsoft Entra. The attacker sets up a rogue EAM provider, which resembles a legitimate Microsoft password prompt to the user while keeping the passwords for themselves. Even after resetting the captured password, the rogue provider remains in the authentication flow and captures the subsequent password during the user's next sign-in.
To build the rogue provider, we created a minimal OpenID Connect (OIDC) server using Python and FastAPI. The server performs two critical functions: appearing identical to the official Microsoft page for the user and meeting the requirements of a compliant EAM provider for Microsoft Entra. When the user enters their password, it is sent to our server, while Microsoft's server receives a signed token from our provider, completing the login without any error.
Our findings emphasize the importance of detecting unauthorized changes to authentication infrastructure and removing rogue providers before resetting affected credentials to prevent this persistent credential trap.
Written by urgent.news from HackerNoon's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
