Oauth third party not departing

The talk examines how OAuth 2 holds up in SaaS environments. It starts with the consent flow, which hands an application a token that keeps working without asking the user again. The speakers note that the original editor of the standard withdrew his name over concerns about complexity, and they recall a 2018 Google Docs worm that abused app scripts to phish contacts. They then describe how Microsoft and Google responded with publisher verification and admin consent requirements for newly registered apps.

The middle section covers attack paths that still work around those controls. Device code flow is the main example: an attacker starts the flow, phishes a victim into entering a code on a legitimate login page, and receives tokens without a client secret or a consent prompt, which can also get past multi-factor checks. The speakers also list persistence options after a compromise, such as adding credentials to an application, changing recovery details, and using legacy protocols that do not enforce MFA.

The closing part presents a watchdog technique. A script uses the Microsoft Graph API and a refresh token to re-enable an app that an administrator has disabled, so access continues quietly. The talk argues that disabling a suspicious app is better practice than deleting it, and it closes with a short section on solutions.