Mac PRT Cookie Theft & Entra ID Persistence
Shang-De Jiang, Dong-Yi Ye, Tung-lin Lee
DEF CON 33 · Day 2 · Main Stage
This DEF CON 33 talk—titled in full "Original Sin of SSO: macOS PRT Cookie Theft & Entra ID Persistence via Device Forgery"—presents a novel attack chain against Microsoft Entra ID (formerly Azure Act
AI review
DEVCORE researchers discovered that the macOS Entra ID implementation exposes the Session Key in a way that enables full device forgery — persistent Entra ID access that survives password resets, device wipes, and MDM re-enrollment — because macOS lacks the Windows TPM-backed key protection model.