Hacker News new | ask | show | jobs
Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts (bleepingcomputer.com)
9 points by OptionOfT 4 days ago
1 comments
arm32 4 days ago
How does MITM work without installing a cert on the victim's machine?
link
rolph 4 days ago
its a DNS hijack, redirecting connection to a registered domain, the page is a spoof of the workflow,with mitigation vs the MFA by abusing OAuth.

the page is HTTPS, an OAuth token is issued to the malignant client.

there is probably some WPAD malarchy in cases.

the entire workflow has minor variations but once an attacker has access to your M365 the chance of having everything you have done with M365 is very likely.

its not exactly MITM its more like Man Offside of the Middle

what happens next depends on the attackers objective.

link
arm32 4 days ago
But what about HSTS and HSTS preloading? This sounds more like a deauth/captive portal phish to me.
link
rolph 3 days ago
the hotspot was pwned and abused

this is a more detailed, and first order account of things from reliaquest itself.

https://reliaquest.com/blog/threat-spotlight-dns-poisoning-t...

apparently a full funnel VPN policy prevents the workflow.

link
gnabgib 4 days ago
It's in the article.. they hijacked the DNS to send the users to an alt phishing website.. looked identical to the Entra (M365) flow.. but the victims were sending their data/secrets/TOTP to hackers on slightly different URLs.

Most people are so used to the login flow, they don't inspect the URLS if the page looks right. Some popups even obscure the URL (almost impossible to detect).

link