The wide world of consent

Consent phishing is a newer type of phishing that has arisen from the adoption of OAuth and cloud based technologies, where legitimate OAuth functionality is exploited by attackers to gain dangerous privileges over a target's account. This can be used by attackers to gain a foothold in a cloud environment or on Saas Applications.

Consent phishing works on the principle of social engineering a user into granting an application privileges over their environment or account. This talk will give an introduction into consent phishing, discuss two main types of applications, and how their OAuth implementations are vulnerable to these attackers. This includes applications that are hosted on trusted hardware, such as a web application, and applications used on untrusted hardware, such as a desktop application.

For each application type, we will use an example of a recorded consent phishing attack to show the full attack flow, as well as its indicators of compromise. Once an attack flow has been conducted, we will perform a review from the blue team perspective and have a look at the logs and alerts that are generated for each example. This will allow the audience to gain a more holistic understanding of the attack, its limitations, and its detections.

This new phishing vector can be used against any technology stack that makes use of OAuth to varying degrees, however, for the purposes of this presentation we will be showcasing the attack on the Microsoft technology stack.

Two examples will be used to demonstrate the points made in the presentation:

These examples will show the real world potential for these attacks, their limitations, and where they could be utilised in an attack path. For each of the attacks we will also look at the logs and alerts generated by my actions.