Defending Against New Phishing Attacks that Abuse OAuth Authorization Flows
summary
Shows concrete attacks: attackers register or reuse OAuth client IDs, send a Microsoft device‑code URL, and with 50 lines of code and social engineering obtain tokens; device codes expire in 900 seconds but the attacker keeps a refresh token persists, uses it to pivot from Office 365 into Azure and often gains admin access. Detections are weak, revocation often only kills refresh tokens, and practical mitigations include centralizing app approvals, blocking device flow, using IP allow lists and disable account for one hour to invalidate active access tokens.
AI-written summary · about
chapters (19)
- 0:00Defending against OAuth phishing
- 1:53Traditional defenses fail with OAuth
- 3:58Understanding OAuth security
- 5:45Illicit consent grant attack
- 8:57MFA and URL filtering ineffective
- 13:16Device code flow attack demo
- 22:55OAuth pivot to cloud access
- 24:22Detecting OAuth-based attacks
- 31:59Vendor collaboration needed
- 33:00Zero-trust for OAuth security
- 37:54Auditing OAuth applications
- 41:08Mitigating OAuth compromise
- 45:20Revoking OAuth tokens
- 47:48Incident response for OAuth
- 51:41High-risk OAuth apps
- 52:46OAuth threat intelligence
- 54:13Q&A: Token expiration trade-offs
- 55:42Q&A: Device code flow risks
- 58:12Q&A: Token validity in attacks
related talks
50mDefending Against New Phishing Attacks that Abuse OAuth Authorization Flows
47mHacking OAuth
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows
55mAzure Attacks Unpacked: Real-World Threats & Lessons
47mTop X OAuth 2 Hacks
26mTechnical Tracks
18mHow to Hack OAuth
01h 00mBreaking and securing OAuth 2.0 in frontends at NDC Security