Modern OAuth: token theft in 2025 and how we can prevent against it

At the core of your organisation's Identity and Access Management (IAM) controls lie access tokens issued through widely adopted OAuth and OpenID Connect (OIDC) protocols from your Identity Provider. These short-lived tokens carry temporary scoped privileges of their owning identity, creating both powerful capabilities and significant security risks. In increasingly common circumstances, these tokens are being stolen and used by malicious actors to bypass critical security controls like Multi-Factor Authentication (MFA).

This session begins with the fundamental concepts of OAuth and OIDC, explaining why these protocols have become the industry standard, what problems they're designed to solve, and how their various authorisation flows work in practice. I'll thoroughly break down what tokens are, how they function within modern authentication architectures, and why secure generation and storage of these tokens is critical to prevent abuse across your digital ecosystem.

Building on this foundation, I'll examine common implementation flaws that are frequently present in major organisations. We'll analyse how seemingly small technical missteps can expose these confidential tokens to attackers, allowing them to bypass security controls, takeover user accounts, and access highly sensitive organisational data. These misconfigurations often go undetected until after a breach has occurred, making preventative knowledge essential for security professionals.

The presentation will include a live demonstration of token theft techniques, showcasing just how straightforward it can be for attackers to exploit minor flaws in OAuth implementations. You'll witness firsthand the attack patterns used to compromise tokens and understand the devastating consequences from an attacker's perspective, providing valuable context for your defensive strategy.

Finally, I'll share actionable defense-in-depth strategies to protect your organisation from these attacks. We'll explore OAuth implementation best practices that can help prevent token theft and reduce impact when breaches occur. The session will cover emerging technologies from Identity Providers, device management solutions, and modern browsers, each providing additional layers of protection against token-based attacks.

By the end of this session, you'll understand not only the theoretical risks of OAuth misconfigurations but also practical steps to secure your identity infrastructure against increasingly sophisticated token theft attacks that threaten organisations across Australia and globally.