DeviceCodePhishing: A New Automated Tool Bypasses MFA & FIDO for Azure Entra Users

DeviceCodePhishing

This is a novel technique that leverages the well-known Device Code phishing approach. It dynamically initiates the flow as soon as the victim opens the phishing link and instantly redirects them to the authentication page. A headless browser automates this by directly entering the generated Device Code into the webpage behind the scenes. This defeats the 10-minute token validity limitation and eliminates the need for the victim to manually perform these steps, elevating the efficiency of the attack to a new level.

What makes Device Code phishing especially dangerous is that no authentication method, not even FIDO, is able to protect against this type of attack. Additionally, the victim interacts with the original website they expect, making it impossible to detect the attack based on a suspicious URL.

Description

DeviceCodePhishing is an advanced phishing tool, which leverages the Device Code Flow. It can be used for phishing access-tokens, which in turn allows to bypass two-factor authentication protection, including accounts that exclusively use FIDO for authentication.

While other tools exist to automate device code phishing attacks, they often come with certain limitations, such as requiring the attacker to convince the victim to open the URL and enter the code within a strict 10-minute time frame. The goal of this tool is to overcomes those limitations by automating the process with a headless browser, which initiates the attack as soon as the victim clicks on the phishing link.

This attack technique is even more dangerous than attacker-in-the-middle (AitM) proxies, because the user enters their credentials on the original webpage, making it nearly impossible to detect the phishing attempt based on a suspicious URL. Additionally, the victim might not need to authenticate interactively because a session is still active. Therefore, the victim has almost no time to realize that this is not legitimate. And not to forget that Device Code Flow is undermining FIDO’s phishing resistance!

Currently, this tool is limited to targeting Microsoft Azure Entra users, but the underlying technique is not restricted to any specific vendor.

For more details, check out the blog post: Phishing despite FIDO, leveraging a novel technique based on the Device Code Flow

How it works

1. The attacker sends a URL to the victim
2. The victim opens that URL
3. When the URL is opened, a headless browser is started, performing the following automated steps:
   • Starts the Device Code Flow with <tenant> and <clientId>
   • Opens the device-code webpage and enters the corresponding user-code
   • The device-code webpage forwards to the URL for interactive authentication (By clicking on “Can’t access your account” and immediately navigating back by clicking the cancel button, see here)
   • Returns the URL for interactive authentication as a redirect to the victim
4. The victim is redirected to the authentication URL
5. The victim completes the authentication
6. The attacker is authenticated

Install & Use