OAuth Token Theft
OAuth Token Theft is a cyber attack where an attacker steals an OAuth access token and uses it to access a users account or application without needing the users password
How it works
A user logs into an application using OAuth
The application receives an access token from the identity provider
The token proves that the user has already been authenticated
If an attacker obtains this token they may be able to use it to access resources allowed by that token
The attacker may not need the users password
Common ways tokens can be stolen
Malicious browser extensions
Phishing pages
Compromised applications
Insecure token storage
Malware
Session hijacking
Leaked tokens in logs or source code
Example
A user authorizes a third party application
The application receives an OAuth token
The token is accidentally exposed through a compromised browser extension
An attacker obtains the token
The attacker sends requests using the stolen token
Get Kevin8ronex’s stories in your inbox
Join Medium for free to get updates from this writer.
The attacker may gain access to the permissions granted to that token
SOC detection
SOC analysts can look for
Unexpected OAuth activity
Login activity from unusual locations
New OAuth applications being authorized
Abnormal API requests
Impossible travel patterns
Sudden token usage from unfamiliar devices
Repeated access using the same token from different locations
Prevention
Use short lived access tokens
Use refresh token rotation
Store tokens securely
Use HTTPS
Apply least privilege permissions
Monitor OAuth application authorization
Revoke suspicious tokens
Enable MFA
Review third party application permissions regularly
Simple definition
OAuth Token Theft means stealing an OAuth token and using it to access resources without having the users password
