Phish in Modern Waters: Vulnerabilities in OAuth Device Code Flow
Jenko Hwong demonstrates weaponizing OAuth 2.0 Device Authorization Grant flows, creating phishing attacks that bypass MFA without fake login domains.
Summary
The Convenience of OAuth 2.0 Device Code Flows
The OAuth 2.0 Device Authorization Grant allows limited-input smart TVs and IoT devices to authenticate users via a short alphanumeric code entered on a browser.
Weaponizing Device Authentication for Phishing
Jenko Hwong illustrates how attackers initiate device login flows and trick target victims into entering the verification code on legitimate identity provider websites (such as Microsoft or Google).
Bypassing Multi-Factor Authentication and Conditional Access
Because the victim authenticates directly on the official provider portal, MFA challenges succeed normally, granting the attacker a persistent OAuth refresh token.
Hardening OAuth Device Flows and User Education
The author provides identity architects with policy recommendations, including restricting device flow authorizations and enforcing device context checks.
Related talks
Live Presentations·48 min
Jenko Hwong
Jenko Hwong demonstrates live phishing attacks exploiting OAuth 2.0 device authorization flows, bypassing MFA and hijacking cloud session tokens.
Main Stage·43 min
Keanu Nys
Demonstrates how red teams can abuse legitimate Microsoft login branding parameters and OAuth endpoints to host convincing, high-trust phishing infrastructure.
Main Stage·36 min
Harrison Sand · Erlend Leiknes
Analyzes the evolution of enterprise phishing defense and demonstrates novel reverse-proxy adversary-in-the-middle tradecraft to bypass modern authentication.