start	end	text
5670	15930	Hi, my name is Nevada and Cam and I created a tool called Squarefish that combines QR codes and OAuth 2.0 device code flow.
15930	29310	We are going to go over some QR code and OAuth device code flow introductory material, touch on some previous research, and then demo both Squarefish and a Squarefish sub-tool called Refresh.
29310	31270	Thank you for joining us.
37830	39150	Who are we?
39770	44430	Cam and I work at SecureWorks and do security research and red teaming.
44430	49890	We wrote a tool called Fish in Suits last year and expanded on that research this year with Squarefish.
49970	58010	I've been doing InfoSec stuff for over 15 years and have held a number of roles through that time with a love of all things offensive.
58350	63190	The past six years have really been focused on offensive security and research.
63710	74710	Cam has been in InfoSec for six years and has authored a large number of tools including O365 Spray, BridgeKeeper, Redirect.Rules, and WhiskeySaml.
80850	83850	So, we're going to start with the basics.
83970	85430	What is a QR code?
85430	89510	I mean, at this point, pretty much everyone knows what a QR code is.
89510	94710	It's a barcode of sorts that contains data, often in the form of a URL.
94770	99870	You can even do some cool things with them, like the moving QR code you see on the screen.
100670	104310	I think everyone can probably guess where that QR code leads you.
113100	120340	Although QR codes have been around for a long time, their usage has really exploded in the last five to ten years.
120380	127200	We see them everywhere, including restaurant menus, user manuals, MFA registration, and even on Super Bowl commercials.
127200	137320	People have become accustomed to using QR codes in their everyday life, and as we saw during the Super Bowl, many will scan them without concern for their content.
142730	145810	So, what is a QR code to an attacker?
145810	150770	The most obvious is probably just redirecting users to malicious sites.
151110	162730	It probably can also work to help bypass some spam and phishing filters, although it's worth noting that Microsoft appears to be checking URLs that are in QR codes in certain formats.
162790	165090	We can talk a bit more about this later.
165550	176030	Another cool way to use QR codes is to embed buzzing or injection type strings in them to test QR code reading software for the applications that consume the data from it.
182220	191520	OAuth device code flow probably isn't as well known, or at least as well understood, as QR codes are, but most folks have probably used it at some point.
191740	196780	The most familiar implementation of this would probably be TV streaming apps and devices.
196940	199440	This is really a great use case for the flow.
199440	205820	It prevents users from having to enter passwords into on-screen keyboards using only a remote control.
213420	218460	Device code flow is also used by Microsoft as well as other cloud providers.
218460	224820	Oftentimes, this involves a client application asking for authentication and OAuth grants.
230870	235690	Here's an illustration of the OAuth device code flow.
235690	244550	The client uses a client ID which identifies the application and a scope which identifies the requested permissions.
244670	251390	The endpoint responds with the device code, user code, and verification URI.
251390	256110	The user can then visit that URI and enter the user code.
256110	263430	They will then be prompted to authenticate and grant the access requested as defined in the application scope.
263850	275430	While this is happening, the original client is polling the back end, waiting for authentication to happen, basically getting a wait response until the user authenticates.
275430	278730	This generally has about a 15-minute window.
279010	291310	After the user authenticates, the response to the polling request will include an access token, a refresh token, if needed for the requested scope, and an ID token.
298420	306900	Last year, when we first looked at the OAuth device code flow, we thought it would be useful as a phishing mechanism, so we wrote a tool called Phish and Suits.
312720	325900	One of the things we were really excited about was that client IDs of verified apps could be found online, and as long as the public flow was enabled on them, you didn't need a client secret to use them for phishing.
325900	334580	The prompt on the right shows the requested permissions when using a verified app with Phish and Suits and getting the verified app check mark.
334840	344120	This was a huge improvement over prior OAuth phishing, which often required registering your own application and usually came with a big unverified warning.
344380	349000	The other great part was that there was no malicious URL required.
349580	356600	Straight from an email or text, a user visited the legitimate Microsoft site and entered the code.
364000	372980	We weren't the only ones that noticed this behavior and how it might be useful for phishing, and other folks published the technique and similar tools as well.
373140	377700	I encourage anyone who wants a deeper dive into the topic to check out their research.
384030	397790	So we've covered some of the pros of OAuth device code phishing, like verified and first-party apps can be used, it adds a layer of obfuscation, and the user enters their credentials into the actual Microsoft site.
397790	399850	But there is a pretty big con.
399850	408270	There's only a 15-minute window from the time the initial code is sent via text or email to when the authentication has to happen.
408550	420270	Since so much of our work is based on statistics and based around a small percentage of success, having our email expire before many users even have the chance to read it obviously creates a problem.
425590	428190	Squarefish is a Python tool that we developed.
428190	436790	It aims to combine QR codes with the OAuth device flow in order to decouple the device flow from the initial phishing email.
436790	443770	This is to prevent the device code that was emailed from expiring prior to the user interacting with it.
446680	455660	An attacker will send a target victim an email that will contain a QR code and information relating to a given pretext.
455800	465020	For example, an attacker will send an email that will contain information regarding the target's Microsoft Authenticator token expiring.
465020	474320	The email will then instruct the user to scan the provided QR code in order to generate a new Microsoft Authenticator token.
474380	482780	The provided QR code will be embedded with a link that directs the target victim to an attacker-controlled Squarefish server.
486920	496820	Once the victim scans the QR code that was provided in the initial phishing email, they will be directed to an attacker-controlled Squarefish server.
496820	500560	The user's email will be passed along as a GET parameter.
500680	507300	Once the victim request is received by the Squarefish server, several tasks occur in the background.
507380	516400	First, the user's browser is redirected away from the Squarefish server to Microsoft's device code authentication webpage.
516400	518300	This happens instantly.
518380	529980	Second, Squarefish will use the victim's email provided via a GET parameter to initiate the OAuth device code flow and retrieve a new device code.
529980	537900	Third, Squarefish will send a follow-up email to the victim containing the retrieved OAuth device code.
537900	552840	The email will attempt to replicate the look and design of an authentic Microsoft OAuth device code email and will provide the direct link to the legitimate Microsoft device code authentication endpoint.
553100	563220	Lastly, once the email has been sent, Squarefish will begin polling Microsoft for authentication until the device code expires.
568400	579560	Once the victim receives the follow-up email from Squarefish that contains the device code, they will visit the legitimate Microsoft endpoint to authenticate the device code.
579580	588900	Once the user enters the provided device code, they will be prompted with a permission request for the given application's client ID.
589160	601080	Since we are able to leverage legitimate existing applications found on the web, we are able to prevent any sort of unverified application warnings displayed to the user.
601100	608820	In many cases, we can leverage verified applications and the user will see a verification blue check mark.
612520	629560	Once the user submits their credentials and authenticates the application via the device code flow, the polling done by Squarefish in the background will identify and pull down the authentication and refresh tokens for the associated user.
629560	633560	The data is then saved locally as a JSON file.
633800	638100	On the next slide, you will see a demo execution of Squarefish.
638100	643360	The demo will include a user scanning the provided QR code off screen.
786170	789690	Additional considerations when using Squarefish.
791450	793310	What about MFA?
793410	800030	So if MFA is required, the user will use it when they're prompted to authenticate.
800030	807890	Although if they are already authenticated, they might not need to enter a password or use MFA at all, depending on their corporate policies.
810140	813680	What about sending emails and the account used to send emails?
813680	817760	Squarefish was built and tested using a Gmail account for sending emails.
818100	822800	And for many reasons, this may not be the best option for actual engagements.
824580	829520	It's also worth noting that the QR code does contain a malicious domain.
829520	833820	This was something that we were able to avoid with our earlier tool Fish and Suits.
833820	836240	There are a couple of things to note here.
836460	846200	One, if malware analysis, either automated or human, checks the link, they will be redirected to the legitimate Microsoft device code site.
846660	850520	So they may not identify it as a phishing site at all.
850680	857720	Two, if anything hits that link, it will send the second email without user interaction.
857860	864800	So you may want to wait to bring the server up a few minutes after you've sent the initial phishing email.
866360	873580	Three, you will want to use all of your other malicious domain tricks to ensure the domain itself isn't flagged.
873900	884960	And four, the big advantage here is that the malicious domain will be visited by the QR code reader on the user's phone, which probably won't be on the corporate network.
884960	890540	And since they are using the QR code reader, it won't be open from the email application.
891380	896500	Also, be sure you're utilizing all your other good phishing techniques and tactics.
896660	900480	And there's some links on this slide for additional resources there.
906180	912480	Now that we have a user's refresh token, we wanted to look into what exactly we could do with it.
912660	923360	Research done by public researchers, as well as our own SecureWorks researchers, Ryan Cobb and Tony Gore, identified what is known as FOCI, or Family of Client IDs.
923940	942940	According to the Family of Client IDs GitHub, undocumented functionality in Azure Active Directory allows a group of Microsoft OAuth client applications to obtain special family refresh tokens, which can be redeemed for bearer tokens as any other client in the family.
943400	951380	What this means is we can effectively exchange our refresh token for a new refresh token associated to a different application.
951580	957620	Along with requesting a new refresh token, we can also modify the scope of the token requested.
962260	976680	With this process, we created a small tool called Refresh to provide an automated and easy method of obtaining a refresh token for a different application and leveraging that access to search and extract data.
976880	988980	Refresh will take in the outputted authentication JSON file from Squarefish and will exchange the refresh token for a token associated with the Microsoft Graph API.
989160	996860	With this token, we are able to search emails, users, groups, organizations, OneDrive, and even SharePoint.
1002510	1016030	Refresh will scrape and search the Microsoft Graph API using the newly exchanged token and will save all of the found data into user-associated JSON files for easy parsing.
1016030	1020390	The next slide will show a demo execution of Refresh.
1070980	1073480	That is it for our presentation.
1073480	1075840	We really appreciate you taking the time to watch it.
1075840	1081560	If you're interested in learning more about us or our tools, feel free to check out the links here.
1081620	1082780	Thanks again.