Session Hijacking, Phishing, and SSO Abuse Explained

BLUF: The video explains how OAuth, specifically the Device Code flow, is exploited in modern phishing attacks to steal session tokens, bypassing traditional security measures like MFA by hijacking the post-authentication session rather than the credentials 19:07.

Key Takeaways:
• OAuth has evolved from simple cloud access to complex identity stacks, but user interfaces often obscure the permissions being granted, leading to blind trust in third-party apps 3:17.
• The Device Code flow was introduced to allow "dumb" devices like smart TVs to authenticate, but it created a new attack vector where users are asked to type codes and visit URLs, facilitating remote phishing 6:07.
• Attackers use valid Microsoft login domains and certificates to host fake Device Code pages, making the phishing attempt appear legitimate to traditional security tools 9:12.
• Once a user authenticates, the attacker receives an API token that grants immediate access to the user's data without needing to bypass MFA, as the authentication was successful 10:39.
• A critical danger is lateral movement via Single Sign-On (SSO); an attacker compromising Office 365 can pivot to access Azure Cloud and other integrated services, escalating privileges significantly 12:01.
• The Primary Refresh Token (PRT) allows passwordless SSO on Windows devices, meaning a compromised token can mint new tokens for multiple apps, acting as a master key to the user's digital identity 15:44.
• MFA is irrelevant in these specific attacks because the attacker steals the valid session token after the user has already passed MFA, rendering the second factor useless against session hijacking 19:07.
• Unlike traditional web cookies which are often bound to IP addresses and user agents, OAuth tokens are frequently not bound by default, allowing attackers to use stolen tokens from different locations 20:43.

Closing Statement:
The industry must move beyond relying solely on MFA and domain validation, focusing instead on detecting anomalous token usage and binding tokens to specific devices or contexts to prevent session hijacking.

Sources:

• 0:14 Introduction to the topic, referencing recent OAuth-related security storms and device code phishing.
• 6:07 Explanation of the Device Code flow designed for dumb devices like smart TVs.
• 9:12 Demonstration of how attackers use valid Microsoft domains to make phishing pages look legitimate.
• 12:01 Description of lateral movement from Office 365 to Azure Cloud via SSO.
• 15:44 Discussion on the Primary Refresh Token (PRT) and its role in passwordless SSO.
• 19:07 Conclusion that MFA does not prevent session token theft after authentication.