Microsoft, Google OAuth flaws can be abused in phishing attacks
Proofpoint researchers have discovered several new, previously unknown methods to initiate a URL redirection attack using Microsoft and others’ popular OAuth2.0 implementations. These attacks can lead to the bypassing of phishing detection and email security solutions, and at the same time, gives phishing URLs a false sense of legitimacy to victims.
OAuth 2.0 is a widely adopted authorization protocol that allows a web or desktop application access to resources controlled by the end-user, such as their email, contacts, profile information, or social accounts.
Open redirection vulnerabilities arise when a web application incorporates user-controllable parameters to specify a redirect link. An attacker can craft a URL for a web application that causes a redirection to an arbitrary external domain. Classic open redirection attacks will hold the redirection target in the URL itself.
The researchers have now discovered that attackers could modify some of the parameters in valid authorization flows, triggering a redirection of the victim to an attacker-supplied site or redirect URL in a registered malicious OAuth app. The detected campaigns using these methods have included Outlook Web Access phishing, PayPal login phishing and credit card harvesting, and the researchers stated these campaigns were live and evolving.
“Phishing innocent users remains the most successful attack method to compromise user credentials and breach your organization’s network in the process. Email protection systems are helpless against these attacks,” concludes Proofpoint.
“By abusing OAuth infrastructure, these attacks deliver malicious emails to their targets undetected. Such attacks on PayPal can lead to theft of financial information such as credit cards. Phishing attacks on Microsoft can lead to fraud, intellectual property theft and more.”
New-school security awareness training can enable your employees to recognize social engineering tactics so they can thwart phishing attacks.
With thanks to the Cyber Defence Alliance and BleepingComputer. The full story is here: https://www.bleepingcomputer.com/news/security/microsoft-google-oauth-flaws-can-be-abused-in-phishing-attacks/
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW