The Wide World of Consent - Jonathon Everatt | BSides Cape Town 2023
Channel: BSides Cape Town
Date: 2023-12-18

The advent and adoption of cloud-based technologies by businesses and users has introduced new attack vectors that malicious actors can try to abuse. One of these attack vectors is a new type of phishing, called consent phishing. In Consent Phishing, an attacker-controlled application requests dangerous or sensitive permissions over a user's account or organisation's tenant. The talk will focus on both the offensive and defensive perspective of the attack and its relevant indicators of compromise.

Introduction.
An introduction to the talk, highlighting what the traditional phishing vectors - like payload and credential phishing - are, and how consent phishing is different.

What is OAuth?
A high level view of how OAuth2.0 work and how authorisation is given. Focus will be on defining the different parties in the flow and their roles.

What is consent?
Background information for how consent grants work with the OAuth2.0 framework. Also a discussion around how authorisation grants are requested and given to users or applications. This will include a consent prompt that a user would receive in this situation.

How is this useful?
Tying together the previous sections we will look at what the legitimate use case is of consent for application. This section will emphasise how this is extremely useful functionality that is not going to be removed.

Turning the good to bad?
Once we understand how consent works and why it is useful we will look at how easily it can be abused. For example, a bot that deletes spam from an inbox is generally also able to spam others from the same inbox.

How do this fit into the phishing playbook?
Exploring the kind of controls that affects this type of phishing and the kind of controls that it bypasses. This section will also introduce consent phishing in Azure and give real world examples of cases where a red team would use consent phishing.

Bringing it all together, making an attack happen.
Pulling together all the aspect of consent phishing to take a high level walk-through of how a consent phishing attack in Azure could be undertaken.

The outcome.
Showcasing a couple different scenarios of a successful consent phishing attack. Including reading user mail, reading files, and higher privileged actions that can be undertaken, provided appropriate consent is granted. This section will also discuss what attackers can do from the context of a successful attack, such as harvesting sensitive information or trying to pivot to an on-premise network.

Finding the bad guys, what IOCs we have.
Once an attack has been executed, we will look at the logs that would be generated. There will be a small switch to a blue team perspective of how to find consent phishing attacks and the type of indicators that one could look for. An interesting point here is that some of the Indicators of Compromise that are provided in Azure logs can be misleading as to the source of compromise.

We've seen Azure what else?
This section will investigate how different technologies have different approaches to managing consent with their application. We will look at what some technologies do better and what others do worse. This section will also try attribute different potential cases of consent phishing and its targets.

Wrapping Up; Is the world burning?
Final thoughts on the presentation so far, reviewing where consent phishing could be used but also the challenges that need to be overcome in order to successfully perform an attack. Discussing as to how this is another tool in a red team's toolbox and something that a blue team should be aware of.

Filmed at BSides Cape Town 2023
AV Sponsored by BITM Cyber Security