search

Device code authentication abuse

hashtag
What Is Device Code Authentication?

LogoIntroducing a new phishing technique for compromising Office 365 accountsaadinternals.comchevron-right
LogoOAuth 2.0 device authorization grant - Microsoft identity platformMicrosoftLearnchevron-right

allows users to sign in to input-constrained devices such as a smart TV, IoT device, or printer. To enable this flow, the device has the user visit a webpage in their browser on another device to sign in. Once the user signs in, the device is able to get access tokens and refresh tokens as needed.

  1. An attacker connects to /devicecode endpoint and sends client_id and resource

  2. After receiving verification_uri and user_code, create an email containing a link to verification_uri and user_code, and send it to the victim.

  3. Victim clicks the link, provides the code and completes the sign in.

  4. The attacker receives access_token and refresh_token and can now mimic the victim.

List of Client IDs

LogoVerify first-party Microsoft applications in sign-in reportsMicrosoftLearnchevron-right

Access tokens are stored for different Client IDs in Azure.

hashtag
Attack

  1. Send POST request to oauth2/devicecode to retreive

    1. User Code

    2. Device code string

    3. Time code expires in

  1. Send user email with the code and a link to "DeviceLogin" to enter the code

    1. https://microsoft.com/deviceloginarrow-up-right

  1. Retrieving the access tokens

Attacker needs to make an http POST to Azure AD token endpoint every 5 seconds:

The request must include the following parameters (code is the device_code from the step 1)

Parameter
Value

client_id

d3590ed6-52b3-4102-aeff-aad2292ab01c

resource

https://graph.windows.netarrow-up-right

device_code

CAQABAAEAAAB2UyzwtQEKR7-rWbgdcBZIGm0IlLxBn23EWIrgw7fkNIKyMdS2xoEg9QAntABbI5ILrinFM2ze8dVKdixlThVWfM8ZPhq9p7uN8tYIuMkfVJ29aUnUBTFsYCmJCsZHkIxtmwdCsIlKpOQij2lJZzphfZX8j0nktDpaHVB0zm-vqATogllBjA-t_ZM2B0cgcjQgAA

grant_type

urn:ietf:params:oauth:grant-type:device_code

If the authentication is pending, an http error 400 Bad Request is returned with the following content:

After successful login, we’ll get the following response (tokens truncated):

hashtag
Detect

LogoHow to Detect Malicious OAuth Device Code Phishingwww.inversecos.comchevron-right

Difficult to detect without browser forensics to look for navigation to https://microsoft.com/devicelogin website.

hashtag
What logs are available?

  • Sign-In logs

  • UAL logs

hashtag
Sign-In Logs:

Azure Sign-Ins will show two simultaneous entries, focus on identifying device code authentication usage.

  • Interactive sign-in (attacker)

  • Non-interactive sign-in (for when attacker accessed resource using stolen oauth token).

hashtag
What will Interactive Sign-In logs show?

  • Shows device code authentication was used.

  • Logon is token based, therefore single factor is used.

  • The TA is using it to gain access to GraphAPI (or what other resource they accessed).

  • Malicious IP

  • Client App: Mobile Apps and Desktop clients

  • User Agent.

  • Authentication Protocol: Device Code.

  • Resource ID: What resource TA requested (i.e. Graph).

A success and failure log will trigger within 10 seconds of each other for a successful devicelogin.

hashtag
What will Non-Interactive Sign-In logs show?

Non-Interactive sign-ins will show how the TA interacted with the access token after gaining access to it.

  • User Agent (anomalies could be curl, python, powershell, etc).

  • Malicious IP

  • Client App: Mobile Apps and Desktop clients.

hashtag
What will UAL logs show?

Located in M365 Defender Portal: https://security.microsoft.com/arrow-up-right

  • Attacker IP triggering "User Logged In" for every operation they perform with stolen token.

  • ExtemdedProperties Request Type: CMSI

    • CMSI: Check my Sign-In (triggered when platform requires user to validate request, i.e. user gives consent to application).

  • Item: Microsoft Graph (resource TA request).

  • Application ID: The client ID the TA is pretending to be (i.e. Microsoft Office).

hashtag
Mitigate

Not a lot of ways to prevent this abuse.

  • Implement location based Conditional Access Policies.

  • Control how a user is allowed to log in to their account.

PreviousOAuth 2.0 AbuseNextM365 Business Email Compromise

Last updated