In July 2023 Microsoft disclosed that a China-based group it tracks as Storm-0558 had been reading email at about 25 organizations, including U.S. government agencies. The attackers never stole a password or got past anyone's MFA prompt. They had obtained one of Microsoft's own signing keys and used it to create authentication tokens that the email service accepted as genuine.
On the CompTIA Security+ SY0-801 exam, attack surfaces like this one sit under objective 2.4, which expects you to recognize the kinds of vulnerabilities organizations carry and the places attackers find them. This lesson covers five that grew with cloud services and mobile work: identity providers, public code repositories and package registries, public object storage, mobile devices, and wireless and low-power radios. It ends with a short note on large language models.
An identity provider is the one system every federated app trusts
An identity provider (IdP), such as Microsoft Entra ID, Okta, Google Workspace or Active Directory Federation Services (AD FS), authenticates users and issues signed tokens or SAML assertions that other applications accept as proof of identity. With single sign-on, dozens or hundreds of SaaS applications trust that signature instead of checking credentials themselves. That puts MFA and conditional access in one place, and it also means whoever controls the IdP controls access to everything federated with it.
Attackers go after an IdP in three main ways:
- Taking over an administrator account. An IdP admin can reset MFA methods, create users, assign roles, or add a federation trust with a signing certificate the attacker controls, which can let the attacker sign in as other users without their passwords.
- Stealing the token-signing key. With the private key that signs assertions, an attacker can forge an assertion for any user, with any group memberships, stating that MFA was completed, for any application that trusts the IdP. Against AD FS this is called a Golden SAML attack, and it was part of the SolarWinds intrusions in 2020. Storm-0558 was a variation of the same idea against Microsoft's own cloud.
- Stealing sessions. In 2023 attackers broke into Okta's customer support system and took troubleshooting files customers had uploaded. Some contained live session tokens, which the attackers used to hijack administrator sessions at several Okta customers.
Forged tokens and stolen sessions skip the password and MFA entirely, so resetting user passwords doesn't remove the attacker. Recovery means rotating the signing keys, revoking sessions and refresh tokens, and checking every federation trust, application registration and admin role for changes.
Treat the IdP as one of the most critical systems you run, on the level of domain controllers. Keep administrators few, with phishing-resistant MFA such as FIDO2 security keys and just-in-time elevation. Keep signing keys in an HSM or the provider's managed key service and rotate them on a schedule. Alert on new federated domains, signing certificates, broadly permissioned app registrations and MFA method changes, send IdP logs to the SIEM, and keep token lifetimes short so revocation takes effect quickly. Federation and single sign-on are covered in the identity and access management section.
Public repositories leak secrets through history and deliver code you didn't write
Public code platforms such as GitHub and package registries such as npm and PyPI create two risks: what you publish, and what you pull in.