T1550.001 Application Access Token

Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.

Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS).(Citation: Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019)

OAuth is one commonly implemented framework that issues tokens to users for access to systems. These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform. Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user. Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.(Citation: okta)

For example, with a cloud-based email service, once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.(Citation: Microsoft Identity Platform Access 2019) With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.(Citation: Staaldraad Phishing with OAuth 2017)

Compromised access tokens may be used as an initial step in compromising other services. For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines. In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.(Citation: Google Cloud Service Account Credentials)(Citation: AWS Temporary Security Credentials) The adversary can then use this token to request data or perform actions the original account could not. If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.(Citation: Rhino Security Labs Enumerating AWS Roles)

Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords. For example, in AWS environments, an adversary who compromises a user’s AWS API credentials may be able to use the sts:GetFederationToken API call to create a federated user session, which will have the same permissions as the original user but may persist even if the original user credentials are deactivated.(Citation: Crowdstrike AWS User Federation Persistence) Additionally, access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.PS-06.01 Secure SDLC process Mitigates T1550.001 Application Access Token
Comments
This diagnostic statement provides for the implementation of secure development practices, such as implementing token binding strategies which can help prevent malicious use of application access tokens.
References
    PR.PS-06.01 Secure SDLC process Mitigates T1550.001 Application Access Token
    Comments
    This diagnostic statement provides secure application development, such as implementing token binding strategies to help prevent the malicious use of application access tokens.
    References
      PR.DS-02.01 Data-in-transit protection Mitigates T1550.001 Application Access Token
      Comments
      This diagnostic statement provide protection from adversaries that may possibly bypass the authentication process and use stolen tokens. Various methods should be used to protect data-in-transit including encryption, password hashing, and tokenization.
      References
        PR.DS-01.01 Data-at-rest protection Mitigates T1550.001 Application Access Token
        Comments
        This diagnostic statement focuses on protecting data-at-rest by implementing encryption and other security measures such as sandboxing, authentication, segregation, masking, tokenization, and file integrity monitoring.
        References
          PR.PS-01.07 Cryptographic keys and certificates Mitigates T1550.001 Application Access Token
          Comments
          This diagnostic statement protects against Application Access Token through the use of revocation of keys and key management. Employing key protection strategies for key material such as those used in generation or protection of application access tokens, limitations to specific accounts along with access control mechanisms provides protection against adversaries trying to compromise application access tokens.
          References
            ID.AM-08.03 Data governance and lifecycle management Mitigates T1550.001 Application Access Token
            Comments
            This diagnostic statement prevents adversaries from being able to steal application access token by bypassing regular authentication methods and accessing restricting accounts and user credentials. There may be some similarities to NIST 800-53 SI-12 Information Management and Retention. This may provide mitigation of data access/exfiltration techniques.
            References
              ID.AM-08.05 Data destruction procedures Mitigates T1550.001 Application Access Token
              Comments
              This diagnostic statement prevents adversaries from being able to steal application access token by bypassing regular authentication methods and accessing restricting accounts and user credentials. There may be some similarities to NIST 800-53 SI-12 Information Management and Retention. This may provide mitigation of data access/exfiltration techniques.
              References
                PR.AA-01.01 Identity and credential management Mitigates T1550.001 Application Access Token
                Comments
                This diagnostic statement protects against Application Access Token through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                References
                  PR.PS-06.07 Development and operational process alignment Mitigates T1550.001 Application Access Token
                  Comments
                  This diagnostic statement protects against Application Access Token through the use of DevSecOps, secure development lifecycle, and application developer guidance. Exploitable weaknesses can be mitigated through secure code, reduced vulnerabilities, and secure design principles.
                  References

                    NIST 800-53 Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    CM-06 Configuration Settings mitigates T1550.001 Application Access Token
                    AC-17 Remote Access mitigates T1550.001 Application Access Token
                    CM-10 Software Usage Restrictions mitigates T1550.001 Application Access Token
                    CM-11 User-installed Software mitigates T1550.001 Application Access Token
                    AC-19 Access Control for Mobile Devices mitigates T1550.001 Application Access Token
                    IA-04 Identifier Management mitigates T1550.001 Application Access Token
                    SC-28 Protection of Information at Rest mitigates T1550.001 Application Access Token
                    SI-12 Information Management and Retention mitigates T1550.001 Application Access Token
                    SC-08 Transmission Confidentiality and Integrity mitigates T1550.001 Application Access Token
                    SI-07 Software, Firmware, and Information Integrity mitigates T1550.001 Application Access Token
                    AC-16 Security and Privacy Attributes mitigates T1550.001 Application Access Token
                    AC-20 Use of External Systems mitigates T1550.001 Application Access Token
                    CM-02 Baseline Configuration mitigates T1550.001 Application Access Token
                    CM-02 Baseline Configuration mitigates T1550.001 Application Access Token
                    IA-02 Identification and Authentication (Organizational Users) mitigates T1550.001 Application Access Token
                    SI-04 System Monitoring mitigates T1550.001 Application Access Token

                    VERIS Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    action.hacking.variety.Use of stolen creds Use of stolen or default authentication credentials (including credential stuffing) related-to T1550.001 Application Access Token

                    GCP Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    identity_aware_proxy Identity Aware Proxy technique_scores T1550.001 Application Access Token
                    Comments
                    This control may mitigate or prevent stolen application access tokens from occurring.
                    References
                    identity_platform Identity Platform technique_scores T1550.001 Application Access Token
                    Comments
                    This control may mitigate application access token theft if the application is configured to retrieve temporary security credentials using an IAM role.
                    References

                    AWS Mappings

                    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                    aws_identity_and_access_management AWS Identity and Access Management technique_scores T1550.001 Application Access Token
                    Comments
                    This control may mitigate against application access token theft if the application is configured to retrieve temporary security credentials using an IAM role. This recommendation is a best practice for IAM but must be explicitly implemented by the application developer.
                    References