DEV Community

CD Security Lab
CD Security Lab

Posted on

If Binance Ran on Microsoft: 4 Locks That Stop a $6.3B Hack

#security #azure #microsoft #kql

Binance's first findings point to one hacked DevOps laptop and about 6.3 billion dollars affected. The investigation is still ongoing, so this is not a claim about exactly how Binance was breached. It is a simple question: if the same four steps happened in a Microsoft tenant, which settings would stop each one, and how do you check your own tenant today?

What we know (initial findings)

  • A DevOps engineer's laptop was compromised; Binance has not said how.
  • From there the attackers reached a server inside the company.
  • No private key was reported stolen: the attackers made Binance's own signing system sign the withdrawals.
  • One transaction carried 50 pre-signed approvals, and about three and a half minutes later that hot wallet was empty.

Microsoft described a trick aimed at developers this year (fake recruiter, coding test, open the repo in VS Code and click "trust"). It is shown in the video as a known technique, not as what happened at Binance.

The 4 locks

  • Hacked laptop: run strangers' code in a throwaway VM; Defender for Endpoint with automatic attack disruption isolates the device
  • Laptop to server: Conditional Access requires a compliant device, Token Protection binds the session (supported apps), PIM removes standing admin rights
  • Signing system made to sign: Key Vault with very few signers, signing rights approved by a second person in PIM
  • 50 signatures in minutes: Microsoft Sentinel alert plus automation disables the identity

What the video covers

  • $6.3B and one laptop (0:00)
  • Step 1: a hacked laptop (0:29)
  • Lock 1: Defender + throwaway VM (0:56)
  • Step 2: laptop to server (1:20)
  • Lock 2: Conditional Access, Token Protection, PIM (1:30)
  • Check your tenant: KQL 1 (2:00)
  • Step 3: the system signed it (2:12)
  • Lock 3: Key Vault + second approver (2:27)
  • Step 4: 3.5 minutes (2:41)
  • Lock 4: Sentinel automation (2:53)
  • KQL 2 and 3 (3:09)
  • Recap: 4 locks (3:20)

KQL to check your tenant

Run these in Log Analytics (Logs). Lab names (contoso.com); replace the admin list with your own accounts. If your workspace uses the resource-specific Key Vault table (AZKVAuditLogs), adapt query 2.

// Door 1: admins signing in from devices that are not compliant
SigninLogs
| where TimeGenerated between (ago(14d) .. now())
| where ResultType == "0"
| where UserPrincipalName in~ ("admin1@contoso.com", "devops1@contoso.com")
| extend Compliant = tostring(DeviceDetail.isCompliant), Device = tostring(DeviceDetail.displayName)
| where Compliant != "true"
| summarize SignIns = count() by UserPrincipalName, Device

// Door 3: a burst of Key Vault sign operations (50 = about 10x the lab baseline)
AzureDiagnostics
| where TimeGenerated between (ago(1d) .. now())
| where ResourceProvider == "MICROSOFT.KEYVAULT" and OperationName == "KeySign"
| summarize Signs = count() by bin(TimeGenerated, 5m), Resource, CallerIPAddress
| where Signs between (50 .. 1000000)

// Who was given access to a key vault in the last 30 days
AzureActivity
| where TimeGenerated between (ago(30d) .. now())
| where OperationNameValue =~ "Microsoft.Authorization/roleAssignments/write"
| where _ResourceId has "/vaults/"
| project TimeGenerated, Caller, _ResourceId
Enter fullscreen mode Exit fullscreen mode

Official Microsoft sources

News sources

All lab data comes from my contoso.com test tenant.

How many admins in your tenant have standing access right now? Tell me in the comments, or watch the full video here: https://youtu.be/RLguDhsYiz0

Thanks for reading! I'm Cuong, and on CD Security Lab I rebuild real Microsoft security cases in a safe lab and explain them simply. Follow along:

Got a question about your own tenant? Drop it in the comments.

Top comments (0)