Permission to Hack You: Illicit Consent Grant Attack

The video demonstrates how attackers exploit OAuth 2.0 through illicit consent grant attacks to compromise Microsoft 365 accounts by tricking users into granting excessive permissions to malicious applications 0:00-0:39.

Key Takeaways:
• OAuth 2.0 is commonly used for account connections but can be abused in spear phishing attacks where attackers create rogue applications to steal sensitive data 1:37-2:07
• Attackers set up malicious Azure apps with broad permissions (email access, files, contacts) and use social engineering to trick victims into granting consent 12:15-15:04
• Once victims grant consent, attackers obtain access tokens that allow them to read emails, access files, and potentially compromise entire organizational data 19:23-21:01
• These attacks can be detected through Azure Entra ID audit logs showing "consent to application" events and by analyzing OAuth request URLs for suspicious client IDs 25:02-25:59

The video highlights both the attacker methodology and defensive measures, emphasizing the importance of carefully reviewing application permissions before granting consent.

Sources:

• 0:00-0:39 Introduction to OAuth 2.0 and security risks
• 1:37-2:07 Explanation of illicit consent grant attacks
• 12:15-15:04 Configuring malicious Azure application with permissions
• 19:23-21:01 Demonstration of successful token theft
• 25:02-25:59 Detection methods through audit logs