OAuth Device-Code Phishing Has Broader Impact in Azure Than Google Cloud
Summary
A technical comparison finds Azure’s device-code flow can let attackers obtain broadly scoped tokens after phishing a user, while Google Cloud restricts available scopes, limiting the attack’s potential. The author notes undocumented options may exist.
Key points
- Attackers can request a device code without authenticating, persuade a victim to sign in and complete MFA, then poll the authentication flow to retrieve tokens.
- In Azure, the attacker selects the requested resource and client ID, which affects the resulting token’s scope and access.
- The article describes Azure tokens that can access Microsoft Graph resources; it also cites prior research demonstrating device-code phishing to obtain a Primary Refresh Token.
- Google Cloud limits device-code flow to a small set of scopes, including narrow Google Drive and YouTube permissions, which the author says substantially limits its usefulness for account takeover.
- Google app creation and verification requirements add friction, though the author says they do not prevent attempts using the currently supported limited scopes.
- The comparison is not definitive: the author cautions that undocumented Google client IDs or scopes could change the assessment.
Article Details
- Attack Vectors
- Device code phishing: an attacker requests an unauthenticated device code, persuades a victim by email to enter it on the legitimate sign-in page and complete authentication, then polls the authentication API to retrieve tokens.
- In the Azure example, the attacker chooses the requested resource and client ID, which can affect the resulting token's scope and access. The article describes potential access to resources as the victim.
- The article demonstrates the same general device-code phishing flow with Google Cloud, but reports that the supported scopes limit the usefulness of the resulting tokens compared with Azure.
- Defensive Notes
- The article notes that users may overlook the warning against entering device codes from untrusted sources when directed to a legitimate sign-in page.
- Google's documented device-code flow supports a restricted set of scopes, which the article says limits the attack's potential compared with Azure.
- The article says Google applications requiring too many powerful permissions must be published and verified before use.
MITRE ATT&CK
T1528 · Steal Application Access TokenAfter the victim authenticates the attacker's device code, the attacker polls the authentication API and retrieves the resulting access and refresh tokens.T1550.001 · Application Access TokenThe article describes using the access token obtained through device code phishing to access resources as the victim.T1566 · PhishingThe described attacker sends a convincing phishing email to persuade a victim to authenticate a device code.
People
Dirk-jan MollemaNamed as a researcher who has written about device code phishing and demonstrated obtaining a Primary Refresh Token through the technique.Dr. Nestori SyynimaaNamed as a researcher who has previously written about device code phishing.Lina LauNamed as a researcher who has previously written about device code phishing.Matt KielyAuthor of the article.
Vendors
Products
AzureHomeBlogHow OAuth 2.0 Device Code Phishing Works in Azure and GoogleGoogle CloudLet’s try to recreate the device code phishing attack using the Google Workspace/Google Cloud APIs.Google DriveAnd in Google, we can use the GDrive file permission scope to *checks notes* “see, edit, create, and delete only the specific Google Drive files you use with this app.”Google WorkspaceLet’s try to recreate the device code phishing attack using the Google Workspace/Google Cloud APIs.Microsoft 365 Apps for EnterpriseDevice Code Phishing in Microsoft 365YouTubeIf any red teamers reading this want to let me know how to pivot the youtube.readonly scope into an account takeover, I’m all ears (not joking, hit me up: matt.kiely[at]huntresslabs.com and I’d love to talk).