The New Social Engineering Playbook Starts With Reconnaissance - Cybersecurity Insiders
A Microsoft password reset feature is leaking valuable user information to attackers, enabling sophisticated social engineering campaigns before any contact is made.
Social engineering attacks have become increasingly sophisticated and frequent, with AI-driven phishing attacks surging 204% year-over-year according to cybersecurity firm Cofense. While AI has advanced these tactics, the true success of these campaigns begins long before hackers make contact with their targets: during reconnaissance. New research from LevelBlue SpiderLabs reveals that Microsoft's Self-Service Password Reset (SSPR) portal can be exploited as a source of early-stage intelligence for attackers.
Microsoft's SSPR portal is a legitimate, trusted feature designed to let users recover their accounts without calling help desk. Users verify their identity using registered second factors like authenticator apps, phone numbers, or alternate email addresses. However, the portal is publicly accessible without prior authentication, and it can confirm whether an account exists and which SSPR verification methods are registered.
The Portal Problem
When SSPR is disabled for standard users, differences in how the portal responds can help attackers identify likely administrator accounts. Even when organizations disable SSPR for standard users, Microsoft keeps it enabled for administrators, creating a distinction that signals which accounts have elevated access. These details don't reveal an account's complete MFA posture but still provide valuable information to attackers.
This intelligence enables various stages of hacker campaigns. Attackers can validate email lists from LinkedIn or company websites, separating real accounts from dead ends. Accounts exposing weaker SSPR verification methods help attackers prioritize targets, while the absence of visible methods provides signals about an account's security posture. SSPR responses can also help attackers spot likely admin accounts and tailor phishing approaches based on known verification methods.
Attack Impact
Social engineering already plays a significant role in real-world intrusions. According to LevelBlue SpiderLabs' Q2 data, phishing was the initial intrusion vector in 65% of incidents observed by incident response teams. The research found that MFA was defeated in every business email compromise case where it was deployed, showing that simply having MFA in place doesn't make organizations immune to modern identity-based attacks.
The more attackers can learn during reconnaissance, the easier it becomes to adapt their techniques to the controls standing in their way.
This shifts the defensive challenge: organizations can't look at each exposure in isolation when attackers are piecing together information from multiple sources to build more targeted attacks.
Mitigation Strategies
Reducing this risk starts with limiting what attackers can learn and strengthening controls. Organizations should strengthen authentication methods by limiting weaker SSPR options like alternate email and security questions where possible, and require stronger verification methods for privileged accounts using phishing-resistant MFA such as FIDO2 or certificate-based authentication.
Other recommended measures include limiting SSPR access to users who genuinely need it, monitoring Entra Audit Logs for unusual SSPR activity, applying stronger authentication to privileged accounts, and evaluating identity infrastructure not just for direct vulnerabilities but also for the intelligence attackers might collect.
Related
