Mac PRT Cookie Theft & Entra ID Persistence

Mac PRT Cookie Theft & Entra ID Persistence

Speakers: Shang-De Jiang, Dong-Yi Ye, Tung-lin Lee

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=T13YfM8z0lE

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Shang-De%20Jiang%20Dong-Yi%20Ye%20Tung-Lin%20Lee%20-%20Original%20Sin%20of%20SSO%20macOS%20PRT%20Cookie%20Theft%20%26%20Entra%20ID%20Persistence%20via%20Device%20Forgery.pdf

Overview

This DEF CON 33 talk—titled in full "Original Sin of SSO: macOS PRT Cookie Theft & Entra ID Persistence via Device Forgery"—presents a novel attack chain against Microsoft Entra ID (formerly Azure Active Directory) targeting macOS devices. The research team from DEVCORE discovered that the macOS implementation of Microsoft's Primary Refresh Token (PRT) mechanism has a critical difference from Windows: the private key material is accessible on macOS in a way that enables PRT cookie theft and subsequent long-term persistence in Entra ID through a technique they call "device forgery."

The talk is significant because enterprise environments increasingly deploy macOS alongside Windows in hybrid identity scenarios, and defenders often assume that Entra ID token theft on macOS mirrors the Windows attack surface. The researchers demonstrate that macOS is actually more vulnerable in important ways because macOS does not have the equivalent of Windows' TPM-backed private key protection for the Entra ID device identity.

Background

▶ Watch: We need to calculate the PRT to the PRT cookie. (2:21)

Microsoft Entra ID and Single Sign-On

Microsoft Entra ID provides identity and access management for Microsoft 365, Azure, and thousands of SaaS applications. It is one of the most widely deployed enterprise identity platforms. When an organization configures a device as an "Entra ID registered" or "Entra ID joined" device, users can achieve Single Sign-On (SSO) to all integrated services without repeatedly entering credentials—a capability implemented through the Primary Refresh Token (PRT) mechanism.

The Primary Refresh Token

The PRT is a long-lived token (up to 14 days) that represents both user identity and device identity. Unlike shorter-lived access tokens, the PRT is stored on the device and used to obtain session tokens for individual applications. The critical security property of the PRT is that it binds together user authentication and device compliance—it is how Conditional Access policies verify that a request is coming from a managed, compliant device.

Windows Implementation

On Windows, the PRT is managed by the Cloud Authentication Provider (CloudAP), which is integrated with the Local Security Authority Subsystem Service (LSASS). The device's private key (Session Key) is stored in the Trusted Platform Module (TPM) and never extracted—operations that require the Session Key are performed inside the TPM. When Windows needs to create a PRT Cookie (the 50-minute-lifetime derivative token used for web SSO), it generates a signed request using the TPM-protected key. Because the key never leaves the TPM, an attacker with user-level or even admin-level access cannot directly extract the raw key material.

macOS Implementation

On macOS, Microsoft's Company Portal and the Microsoft Identity Broker implement PRT functionality. However, macOS does not have a TPM—it has the Secure Enclave. The macOS implementation does use the Secure Enclave for key generation, but the researchers found that the key protection model differs from Windows in critical ways that enable the attack.

Key Findings

▶ Watch: found that this run application function only work with d process. (12:57)

PRT Cookie can be extracted on macOS. The macOS Microsoft Identity Broker stores PRT-related cryptographic material in a way that allows a local attacker with sufficient privilege to extract or use it outside its intended context. The PRT Cookie itself—the short-lived derivative token—can be captured from memory or from process communication channels.

Device forgery via Session Key extraction. The most significant finding is that the Entra ID Session Key (the device identity private key) is accessible on macOS in a way it is not on Windows. With the Session Key, an attacker can craft signed authentication requests that impersonate the victim device. This is "device forgery"—the attacker does not just steal a token, they acquire the ability to generate new tokens as if they are the legitimate device, indefinitely.

Persistence without the original device. Because the Session Key enables device impersonation, an attacker who extracts it can maintain Entra ID access even after:

• The victim user changes their password.
• The IT team remotely wipes the victim device.
• The victim's device is de-registered from Entra ID and re-enrolled.

The only remediation that eliminates the forged device's access is revoking the specific device registration associated with the stolen Session Key.

Entra ID Conditional Access bypass. Conditional Access policies that restrict access to "compliant devices" can be bypassed because the attacker presents a valid device certificate and signature—the policy cannot distinguish the legitimate device from the forged one.

PRT Cookie lifetime extension via session key. With the Session Key, an attacker can generate new PRT Cookies at will (each valid for 50 minutes), effectively maintaining continuous access by refreshing before expiry.

Technical Deep Dive

▶ Watch: found that uh this process core method is just the tip of the iceberg. (19:25)

PRT Architecture on macOS

On macOS, the Microsoft Identity Broker (com.microsoft.CompanyPortalMac and the related broker components) manages PRT operations. The broker communicates with Entra ID over HTTPS using MSAL (Microsoft Authentication Library). Device enrollment creates an Entra ID device object and issues a device certificate and Session Key.

The Session Key is a symmetric key used to sign Proof-of-Possession (PoP) tokens—specifically, the nonce-signed claims that prove the device is in possession of the key material at the time of the token request. On Windows, this signing happens inside the TPM via a DPAPI-wrapped key that never leaves protected memory. On macOS, the key material is accessible to the broker process and, under certain conditions, to an attacker with the ability to inspect broker process memory or the keychain.

Keychain and Secure Enclave Interaction

macOS stores cryptographic keys in the system Keychain, which can use the Secure Enclave for hardware-backed key protection. However, not all keys stored by the Microsoft broker are Secure Enclave-backed, and the access control attributes on the relevant keychain items allow access by the broker process without user interaction. A local attacker with code execution in the user's context (same UID) or with admin rights can:

1. Access the keychain items directly using security CLI or SecKeychainFind APIs.
2. Inject code into the broker process and invoke key material directly.
3. Capture the PRT Cookie from IPC channels (XPC) between the broker and the Microsoft SSO extension.

Device Forgery Attack Flow

1. Attacker gains code execution on a macOS device registered with Entra ID (e.g., via phishing, malicious app, or post-exploitation).
2. Attacker extracts the Session Key and device certificate from the broker's keychain items.
3. On attacker-controlled infrastructure, the Session Key is used to sign Proof-of-Possession tokens for Entra ID token requests.
4. Entra ID issues tokens to the attacker as if they were the legitimate registered device.
5. Attacker maintains access through password resets, device wipes, and MDM policy changes—until the device registration is explicitly revoked.

Comparison with Windows Attack Surface

The researchers note an irony highlighted in the talk title ("Original Sin of SSO"): the Windows implementation's TPM-based protections make this specific attack much harder. On Windows, an attacker with local admin can extract PRT Cookies (as demonstrated in prior research by others), but cannot extract the raw Session Key—meaning each access requires a fresh exploit or persistence mechanism on the target device. On macOS, the Session Key extraction enables attacker autonomy: the forged device persists independently.

Demo / Proof of Concept

▶ Watch: And something need to notice that we c (29:54)

The talk includes demonstrations of:

• Session Key extraction from a macOS device enrolled in Entra ID, showing the key material retrieved from the keychain.
• PRT Cookie generation using the extracted Session Key on an attacker machine, without any interaction with the original device.
• Access to Microsoft 365 (Exchange Online, SharePoint) using the forged device token, demonstrating bypassed MFA and Conditional Access.
• Persistence after device wipe: The victim device is wiped and re-enrolled. The forged device token continues to authenticate successfully until the device registration is manually revoked in Entra ID admin console.

Defensive Implications

▶ Watch: So the NGC NGC MFA protection is a good idea. (32:42)

For Entra ID administrators:

• Regularly audit registered device objects in Entra ID for suspicious entries (devices with unusual names, unexpected operating systems, or registration dates that don't match known enrollment events).
• Implement Conditional Access policies that check device compliance status via Intune—a wiped device that re-enrolls will have a new compliance record, which can be used to detect anomalies.
• Enable Entra ID sign-in logs monitoring and alert on authentication from new device IDs for existing user accounts.
• After any suspected endpoint compromise on macOS, revoke all device registrations for that user in Entra ID, not just reset credentials.

For Microsoft:

• The macOS implementation should match the security model of Windows by ensuring the Session Key is stored in Secure Enclave with kSecAttrTokenIDSecureEnclave and appropriate access control (kSecAccessControlBiometryAny or equivalent) that prevents silent access by other processes.
• Entra ID should detect and alert on "device cloning" patterns—simultaneous or geographically anomalous authentication from the same device ID.

For endpoint security:

• Monitor for unusual access to Microsoft Identity Broker keychain items.
• Detect IPC eavesdropping on Microsoft SSO extension XPC services.
• Include Entra ID Session Key theft in endpoint detection rules alongside LSASS credential dumping.

Key Takeaways

1. macOS Entra ID devices are more vulnerable to persistent token theft than Windows devices due to differences in how Session Keys are protected.
2. Extracting the Session Key (not just a PRT Cookie) enables device forgery—an attacker-controlled virtual device that persists indefinitely in Entra ID.
3. Standard incident response actions (password reset, device wipe) are insufficient to evict an attacker who has performed device forgery.
4. Entra ID Conditional Access policies that trust "registered devices" can be bypassed by device forgery, undermining a core enterprise security control.
5. Organizations operating macOS fleets in Entra ID hybrid environments should treat this as a critical identity threat and implement the recommended monitoring and response controls.

About the Speaker(s)

▶ Watch: PR key cookies on Mac OS is now is a reality. (43:46)

Shang-De Jiang (handle: HeapJiang) is Director of Research at DEVCORE, a security research and penetration testing firm. He is a prolific conference speaker and blogger focusing on Windows and cloud identity security, with this being his first DEF CON appearance. Dong-Yi Ye and Tung-lin Lee are security researchers at DEVCORE who contributed to the macOS identity broker analysis. The research team is known for deep dives into enterprise authentication infrastructure, including prior work on Active Directory and on-premises Microsoft identity services.