๐จ ๐ข๐๐๐๐ฎ๐ง๐๐ป๐ฒ: ๐ง๐ต๐ฒ ๐๐ผ๐ฟ๐๐ฎ, ๐ป๐ผ๐-๐ฟ๐ฒ๐ฎ๐น๐น๐, ๐ณ๐ถ๐
Earlier this year, I disclosed a security flaw in Microsoft Intuneโs Conditional Access device filtering โ where attackers with local admin rights could ๐จ๐ฅ๐ค๐ค๐ ๐๐๐ซ๐๐๐ ๐ฅ๐ง๐ค๐ฅ๐๐ง๐ฉ๐๐๐จ like device.model to ๐๐ฎ๐ฅ๐๐จ๐จ ๐ฅ๐ค๐ก๐๐๐ฎ ๐๐ฃ๐๐ค๐ง๐๐๐ข๐๐ฃ๐ฉ.
At first, it was marked โ๐ฝ๐ฎ ๐ฟ๐๐จ๐๐๐ฃ.โ
Then โ๐๐ค๐๐๐ง๐๐ฉ๐ ๐จ๐๐ซ๐๐ง๐๐ฉ๐ฎ.โ
Now, Microsoft says itโs โ๐๐๐ญ๐๐.โ
๐ฉน ๐ช๐ต๐ฎ๐ ๐ฐ๐ต๐ฎ๐ป๐ด๐ฒ๐ฑ?
โข Documentation now warns that ๐จ๐ค๐ข๐ ๐๐๐ซ๐๐๐ ๐ฅ๐ง๐ค๐ฅ๐๐ง๐ฉ๐๐๐จ ๐๐ง๐ ๐ช๐ฃ๐ฉ๐ง๐ช๐จ๐ฉ๐๐
โข UX nudges were added in the CA policy editor and dashboard
โข My name will appear in the MSRC researcher acknowledgements
๐ ๐ช๐ต๐ฎ๐ ๐ฑ๐ถ๐ฑ๐ปโ๐ ๐ฐ๐ต๐ฎ๐ป๐ด๐ฒ?
โข ๐๐ค ๐ฉ๐๐๐๐ฃ๐๐๐๐ก ๐๐ค๐ฃ๐ฉ๐ง๐ค๐ก๐จ prevent tampering
โข Attackers can still ๐ข๐ค๐๐๐๐ฎ ๐ง๐๐๐๐จ๐ฉ๐ง๐ฎ ๐ซ๐๐ก๐ช๐๐จ and pass Conditional Access checks
โข ๐ฟ๐๐ซ๐๐๐ ๐ฉ๐ง๐ช๐จ๐ฉ ๐๐จ ๐จ๐ฉ๐๐ก๐ก ๐ฌ๐ง๐๐ฉ๐๐๐ก๐ ๐๐ฎ ๐ฉ๐๐ ๐๐๐ซ๐๐๐
New blog post here โ
๐ https://cirriustech.co.uk/blog/outtatune-tunedout/
If you rely on Intune or Entra for Zero Trust enforcement, ๐ฟ๐ฒ๐ฎ๐ฑ ๐๐ต๐ถ๐.
And maybeโฆ stop trusting the registry.
#Microsoft #Intune #Entra #ConditionalAccess #EndpointSecurity #OuttaTune #CyberSecurity #Bypass #ZeroTrust #DefenseEvasion
G :donor: :Tick:
npub16eโฆl59dp
2025-08-04 21:40:28 UTC
Author Public Key
npub16ezqaqcxhc8y03e2pwkct7j2l67z06l7xrwlz5lkdu9qfs58zwtqyl59dpSeen on
wss://relay.momostr.pinkPublished at
2025-08-04 21:40:28 UTCEvent JSON
{
"id": "9e3d1329cb4d4c83f853dc536a1b37407cd7fcbc92f90ae16fb705324e6c09ed",
"pubkey": "d6440e8306be0e47c72a0bad85fa4afebc27ebfe30ddf153f66f0a04c2871396",
"created_at": 1754343628,
"kind": 1,
"tags": [
[
"t",
"microsoft"
],
[
"t",
"bypass"
],
[
"proxy",
"https://infosec.exchange/@cirriustech/114972664012371381",
"web"
],
[
"t",
"cybersecurity"
],
[
"t",
"defenseevasion"
],
[
"t",
"entra"
],
[
"t",
"conditionalaccess"
],
[
"t",
"endpointsecurity"
],
[
"t",
"zerotrust"
],
[
"t",
"intune"
],
[
"t",
"outtatune"
],
[
"proxy",
"https://infosec.exchange/users/cirriustech/statuses/114972664012371381",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/cirriustech/statuses/114972664012371381",
"pink.momostr"
],
[
"-"
]
],
"content": "๐จ ๐ข๐๐๐๐ฎ๐ง๐๐ป๐ฒ: ๐ง๐ต๐ฒ ๐๐ผ๐ฟ๐๐ฎ, ๐ป๐ผ๐-๐ฟ๐ฒ๐ฎ๐น๐น๐, ๐ณ๐ถ๐
\n\nEarlier this year, I disclosed a security flaw in Microsoft Intuneโs Conditional Access device filtering โ where attackers with local admin rights could ๐จ๐ฅ๐ค๐ค๐ ๐๐๐ซ๐๐๐ ๐ฅ๐ง๐ค๐ฅ๐๐ง๐ฉ๐๐๐จ like device.model to ๐๐ฎ๐ฅ๐๐จ๐จ ๐ฅ๐ค๐ก๐๐๐ฎ ๐๐ฃ๐๐ค๐ง๐๐๐ข๐๐ฃ๐ฉ.\n\nAt first, it was marked โ๐ฝ๐ฎ ๐ฟ๐๐จ๐๐๐ฃ.โ\nThen โ๐๐ค๐๐๐ง๐๐ฉ๐ ๐จ๐๐ซ๐๐ง๐๐ฉ๐ฎ.โ\nNow, Microsoft says itโs โ๐๐๐ญ๐๐.โ\n\n๐ฉน ๐ช๐ต๐ฎ๐ ๐ฐ๐ต๐ฎ๐ป๐ด๐ฒ๐ฑ?\nโข Documentation now warns that ๐จ๐ค๐ข๐ ๐๐๐ซ๐๐๐ ๐ฅ๐ง๐ค๐ฅ๐๐ง๐ฉ๐๐๐จ ๐๐ง๐ ๐ช๐ฃ๐ฉ๐ง๐ช๐จ๐ฉ๐๐\nโข UX nudges were added in the CA policy editor and dashboard\nโข My name will appear in the MSRC researcher acknowledgements\n\n๐ ๐ช๐ต๐ฎ๐ ๐ฑ๐ถ๐ฑ๐ปโ๐ ๐ฐ๐ต๐ฎ๐ป๐ด๐ฒ?\nโข ๐๐ค ๐ฉ๐๐๐๐ฃ๐๐๐๐ก ๐๐ค๐ฃ๐ฉ๐ง๐ค๐ก๐จ prevent tampering\nโข Attackers can still ๐ข๐ค๐๐๐๐ฎ ๐ง๐๐๐๐จ๐ฉ๐ง๐ฎ ๐ซ๐๐ก๐ช๐๐จ and pass Conditional Access checks\nโข ๐ฟ๐๐ซ๐๐๐ ๐ฉ๐ง๐ช๐จ๐ฉ ๐๐จ ๐จ๐ฉ๐๐ก๐ก ๐ฌ๐ง๐๐ฉ๐๐๐ก๐ ๐๐ฎ ๐ฉ๐๐ ๐๐๐ซ๐๐๐\n\nNew blog post here โ\n๐ https://cirriustech.co.uk/blog/outtatune-tunedout/\n\nIf you rely on Intune or Entra for Zero Trust enforcement, ๐ฟ๐ฒ๐ฎ๐ฑ ๐๐ต๐ถ๐.\nAnd maybeโฆ stop trusting the registry.\n\n#Microsoft #Intune #Entra #ConditionalAccess #EndpointSecurity #OuttaTune #CyberSecurity #Bypass #ZeroTrust #DefenseEvasion",
"sig": "157788a1311901fbb4241e1d36a6ab5c2cadcb7db87437d8ebd9eb0e3b6032e020952f24b7815fe47aaa007646ab131ea0da65668a024df7e85a8ee2208acc88"
}