Tumelelo ya OAuth ya go Phisha le go Phimola Ditetlelelo tsa Tiriswa e e Kotsi ya Motho yo Mongwe¶

Akanya fela o lemoga gore motlhasedi o bala diimeile tsa gago tsa poraefete ka tlhagafalo, o laisolola ditokumente tsa gago tsa kwa marung, o tlhama melao ya go fetisetsa lebokoso la poso le le didimetseng, kgotsa o romela dikgokagano tsa tsietso go tswa mo akhaontong ya gago, le fa o sa tswa go fetola nomoro ya gago ya sephiri go nna mogala o o sa rulaganngwang wa ditlhaka di le 24 le go kgontsha hardware Two-Factor (2FA / Passkeys). Go tla jang gore motlhasedi a bo a sa ntse a le mo teng ga akhaonto ya gago ya Lefelotiro la Google, Microsoft 365, GitHub, Slack, kgotsa Discord a sa itse nomoro ya gago e ntšha ya sephiri kgotsa a sa tsose tlhagiso e le nngwe ya 2FA? Ka gonne o nnile motswasetlhabelo wa Phishing ya Tumelelo ya OAuth 2.0 (e e itsiweng gape jaaka Kabo ya Tumelelo e e seng Molaong kgotsa Phishing ya Khoutu ya Sediriswa). Mo boemong jwa go go tsietsa gore o thaepe nomoro ya gago ya sephiri mo tsebeng ya maaka ya go tsena, motlhasedi o go rometse kgokagano ya nomoro ya mmatota . accounts.google.com kgotsa login.microsoftonline.com sekerini sa tetlelelo se se botsang gore a tiriswa e e bidiwang "PDF Document Viewer," "eSign Security Check," "Zoom Meeting Recorder," kgotsa "Mail Backup Assistant" e ka nna le tetla ya go "Bala, go tlhama, go romela, le go phimolela ruri imeile yotlhe ya gago mo Gmail" kgotsa "Nna le phitlhelelo e e feletseng ya difaele tsotlhe tse o kgonang go di bona."

Motsotso o o tobeditseng Allow kgotsa Accept mo lebokosong leo la puisano la mmatota la Microsoft kgotsa Google, motlamedi wa boitshupo o ne a naya sefara ya motlhasedi tshedimosetso ya sephiri e e nnelang ruri OAuth Refresh Token (offline_access). Ka gonne dithokene tsa API tsa OAuth 2.0 di netefatsa ka tlhamalalo kgatlhanong le di-API tsa REST/Gh tsa kwa morago (graph.microsoft.com kgotsa gmail.googleapis.com) gotlhelele go sa kgathalesege thulaganyo ya gago ya webo ya batho, go fetola nomoro ya gago ya sephiri kgotsa go tsenya 2FA gantsi go tlogela dithuso tsa tiriswa tse di kotsi tsa motho yo mongwe di dira ka diperesente di le 100. Go lotlela motlhasedi gotlhelele, o tshwanetse go phimola ka seatla thebolelo ya kopo ya motho wa boraro, o bolaye dithokene tsotlhe tse di ntshitsweng tsa OAuth tsa go tsosolosa le tsa phitlhelelo, le go phepafatsa dikgoro dipe tsa kwa morago tse tiriswa e di tlhamileng fa e ntse e na le phitlhelelo ya API.

Dira se jaanong¶

1. Tlhaloganya ka bonako gore ke eng fa go fetola nomoro ya gago ya sephiri go SA emisa motseneledi: o tshwanetse go phimola Third-Party App / OAuth Consent Grant mo teng ga portal ya tshireletso ya akhaonto ya gago. Fa o tobetsa Allow mo sekirining sa OAuth, o tlhama konteraka ya API ya motšhini-go-motšhini e e sa kgaotseng (Service Principal / OAuth App Token). Eya ka tlhamalalo kwa tsebeng ya Ditiriso le Ditirelo tsa Mokgatlho wa Boraro ya motlamedi wa gago gone jaanong (myaccount.google.com/connections ya Google, myapps.microsoft.com kgotsa account.live.com/consent/Manage ya Maekerosofa, github.com/settings/applications for GitHub) mme o tobetse Tlosa Phitlhelelo / Phimola mo tirisong nngwe le nngwe e o sa e lemogeng le go e tshepa ka diperesente di le 100.
2. Fa o thaepile khoutu ya ditlhaka le dinomoro ya ditlhaka di le 8 kgotsa di le 9 mo microsoft.com/devicelogin, google.com/device, kgotsa github.com/login/device ka nako ya mogala wa phishing kgotsa motlotlo, phimola bobedi jwa gago Active Device Sessions LE OAuth App Grants ka bonako. Mo Tlhaselong ya Phishing ya Kelelo ya Khoutu ya Sediriswa (RFC 8628), motlhasedi o ntsha khoutu ya go kopanya ya smart-TV/CLI mo khomphuteng ya gagwe mme a go tsietse gore o thaepe khoutu eo mo khomphuteng ya mmatota . microsoft.com/devicelogin tsebe. Go thaepa khoutu eo go naya motlhasedi ** ya konokonoRefresh Token (PRT / Multi-Resource Refresh Token)** e itira tlelaente ya Ofisi ya Microsoft ya tlholego, Azure CLI, kgotsa Diakhaonto tsa Inthanete tsa Apple.
3. Fa o sena go phimola tiriswa e e kotsi ya OAuth, tlhatlhoba Imeile ya gago ka bonako Forwarding Rules, Inbox Filters, le Delegated Mailbox Access ka Graph/Gmail UI. Ke eng selo sa ntlha se tiriswa e e kotsi ya OAuth e se dirang mo 500 milliseconds morago ga go tobetsa Allow? E dirisa Mail.ReadWrite kgotsa MailboxSettings.ReadWrite Sekoupu sa API go tsenya molao o o sa bonaleng wa lebokoso la poso la sefara o o romelang kwa pele ka itiriso banka nngwe le nngwe e e tsenang, crypto, kgotsa imeile ya go seta sešwa nomoro ya sephiri kwa motlhaseding le go romela dikarabo ka tlhamalalo kwa go wena Trash kgotsa RSS Feeds foltara (bona Akhaonto ya imeile e thubilwe: melao ya go fetisa le go busetsa).
4. Tlhola gore a tiriswa e e kotsi ya OAuth e kwadisitse tiriswa OAuth ya bobedi ya bekapo, Letshwao la Phitlhelelo ya Botho (PAT), Senotlolo sa SSH, kgotsa mokgwa wa MFA fa e ntse e na le dikoupu tsa botsamaisi. Mo ID ya Microsoft Entra (Azure AD), GitHub, le Lefelo la Tiro la Google, tiriswa e ne e naya dikoupu tsa lenaane kgotsa tsa taolo ya akhaonto (Application.ReadWrite.All, RoleManagement.ReadWrite.Directory, kgotsa GitHub admin:public_key) e ka tlhama ka tidimalo letshwao la API le le fitlhegileng la bobedi kgotsa mogokgo wa tirelo gore motlhasedi a nne le phitlhelelo morago ga gore o phimole tiriswa ya ntlha.
5. Fa se se diragetse mo khamphaning kgotsa mo sekolong Microsoft 365 kgotsa Google Workspace akhaonto, leletsa Lefelo la gago la Tshireletso ya IT / SOC Helpdesk mo metsotsong e le 5. Modiri a le mongwe fela yo o tobetsang Accept mo kgolaganong ya go tsietsa ya OAuth e ka naya motlhasedi phitlhelelo ya go buisa SharePoint, OneDrive, dipuisano tsa Ditlhopha, le Lenaane la Diaterese tsa Lefatshe Lotlhe tsa khamphani yotlhe, e simolola go Tsenya Imeile ya Kgwebo ka fa gare (BEC) tlhaselo ya tsietso ya megala kgatlhanong le badirimmogo le wena le ditlelaente.
6. Fa e le gore motlhasedi o dirisitse phitlhelelo ya OAuth go leba di-drive tsa gago tsa kwa marung (Google Drive / OneDrive), dipoelo tsa lekgetho, diromelwantle tsa nomoro ya sephiri, kgotsa ditatamente tsa matlole, gatsetsa difaele tsa gago tsa sekoloto le go tswalela diakhaonto tsa matlole. Fa e le gore ditokomane tsa boitshupo tse di botlhokwa kgotsa dipolelwana tsa peo/dinomoro tsa sephiri di ne di bolokilwe mo polatefomong ya kwa marung e tiriswa ya OAuth e neng ya e fitlhelela, tshwara faele nngwe le nngwe mo polatefomong eo jaaka e laisolotswe ke motlhasedi (bona Tsibogo ya go tlolwa ga tshedimosetso le go dutla ga nomoro ya sephiri).

flowchart TD
    A["Go belaelwa ga go Tsena mo Akhaontong ka Tumelelo ya OAuth kgotsa go Tsena mo Akhaontong ka Ntlha Morago ga go Seta Sešwa Nomoro ya Sephiri"] --> B["1. Bula Portal ya Ditetlelelo tsa Tiriso ya Motho yo mongwe (Dikgolagano tsa Google / Ditiriso tsa Me tsa Microsoft / Ditiriso tsa GitHub)"]
    B --> C["2. Tsaya senepe sa ditiriso tse o sa di tlwaelang go bona bosupi, o bo o tobetsa 'Phimola / Tlosa Phitlhelelo' mo Tirisweng nngwe le nngwe e e belaetsang ya OAuth"]
    C --> D{"A o tsentse khoutu mo tsebeng ya go Tsena mo Sedirisweng (ka sekai, microsoft.com/go tsena mo sedirisweng)?"}
    D -->|"Ee: Go Utswa Khoutu ya Sediriswa (RFC 8628)"| E["Diragatsa 'Tswa Gongwe le Gongwe / Phimola Dithokene Tsotlhe Tsa Ntšhwafatso' go bolaya mananeo a CLI / Khoutu ya Sediriswa"]
    D -->|"Nnyaa: Thebolelo ya OAuth ya Webo e e Tlwaelegileng"| E
    E --> F["3. Boruni & Phimola Dikgoro tsa Morago tsa Bobedi tse di Tlhamilweng ke Letshwao la API"]
    F --> G["Tlhola Melao ya Lebokoso la Imeile, Go Fetisetsa Kwa Pele ka Boitiriso, le Phitlhelelo e e Rometsweng (Gmail / Outlook)"]
    F --> H["Tlhola Dithokene tsa Phitlhelelo ya Botho tsa Motlhabolodi (PATs), Dinotlolo tsa SSH, le Dikopanyo tsa Webhook"]
    F --> I{"A eno e ne e le Akhaonto ya Lefelo la Tiro la Microsoft 365 / Google?"}
    I -->|"Ee"| J["Tlhagisa Motsamaisi wa Kgwebo / SOC ka bonako go phimola Thebolelo ya Mogokgo wa Tirelo mo Entra ID / Motsamaisi wa Lefelo la Tiro"]
    I -->|"Nnyaa (Akhaonto ya Botho)"| K["Fetola nomoro ya sephiri + Tlhomamisa didiriswa tsa MFA + Tlhola Dipegelo tsa Tiro tsa Laisolola tsa Cloud Drive"]

Kafa Phishing ya Tumelelo ya OAuth 2.0 e tlolang dikhunololamoraba le 2FA (Tlhago ya Setegeniki) ka gone¶

Ke ka ntlha yang fa ditlhopha tsa dikebekwa tsa inthanete, ditlhopha tsa ditlhodi tsa puso (Midnight Blizzard, Star Blizzard).

1. Go Utswa ka Tlwaelo kgatlhanong le Go Utswa ka Tumelelo ya OAuth kgatlhanong le go Utswa ka Khoutu ya Sediriswa¶

2. Kopo ya Batlhasedi ba Tetlelelo ya OAuth e e Kotsi e Kgolo¶

Fa o tlhatlhoba tiriswa mo lenaaneng la gago la ditetlelelo, leba ka kelotlhoko dikarolo tse e di kopileng: * Kerafo ya Maekrosofote (Entra ID / Microsoft 365 / Outlook.com): * Mail.Read, Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite (E letla go bala diimeile tsotlhe, go romela diimeile jaaka wena, le go tlhama melao e e fitlhegileng ya go fetisetsa lebokoso la poso). * Files.Read.All, Files.ReadWrite.All, Sites.ReadWrite.All (E letla go laisolola faele nngwe le nngwe mo OneDrive ya gago le foltara nngwe le nngwe ya SharePoint ya khamphani e e abelanwang). * offline_access (E letla sefara ya motlhasedi go dira Di-Access Tokens tse disha ka tidimalo 24/7 le fa khomphutha ya gago e timilwe). * Directory.ReadWrite.All, AppRoleAssignment.ReadWrite.All, User.ReadWrite.All (Dikoupu tsa go oketsega ga tshiamelo ya kgwebo ya masetlapelo). * Lefelo la Tiro la Google / Gmail ya Botho (Google APIs): * https://mail.google.com/ kgotsa gmail.modify / gmail.settings.basic / gmail.settings.sharing (Taolo e e feletseng ya go bala, go phimola, le go fetisetsa Gmail kwa pele). * https://www.googleapis.com/auth/drive (Phitlhelelo e e feletseng ya go buisa/kwala/laisolola faele nngwe le nngwe mo Google Drive ya gago). * https://www.googleapis.com/auth/cloud-platform (Taolo e e feletseng ya mafaratlhatlha a Google Cloud le go duela). * GitHub le Dithulaganyo tsa Tikologo tsa Batlhabolodi (GitHub Apps / OAuth Apps): * repo le workflow (Phitlhelelo e e tletseng ya go bala/kwala mo mabolokelong otlhe a poraefete a khoutu ya motswedi le tetla ya go tsenya dipeipi tse di kotsi tsa GitHub Actions CI/CD tse di utswang diphiri). * admin:org, admin:public_key, le admin:gpg_key (Tetla ya go tsenya dinotlolo tsa SSH tsa backdoor tse di sa kgaotseng kgotsa go fetola botokololo jwa mokgatlho). * Dibogolo tsa OAuth tsa Slack le Discord: * Go repa channels:history, groups:history, im:history, files:read, le chat:write (E letla tiriswa e e tswang kwa ntle go bala melaetsa yotlhe e e tlhamaletseng ya setlhopha sa poraefete, go tlhotlhora di-PDF tse di laisitsweng le dintlha tsa boitshupo, le go romela dikgokagano tsa phishing tse di itirang jaaka modirimmogo yo o ikanyegang). * Kganetsano guilds.join le identify (E letla bot e e tsenngwang mo kotsing kgotsa portal ya netefatso go tsena ka dikgoka mo akhaontong ya gago ya Discord mo disefareng tsa tsietso kgapetsakgapetsa kwantle ga tumelelo ya gago).

Kgato 1: Go phimolwa ga OAuth le Tiriswa ya Mokgatlho wa Boraro ka kgato mo polatefomong nngwe le nngwe e kgolo¶

Latela dikgato tse di fa tlase ka nepo tsa akhaonto nngwe le nngwe e o tobeditseng kgokagano e e belaetsang mo go yone, o dirisitse "Saenela go tsena le Google / Microsoft / Apple / GitHub / Discord" mo saeteng e e sa ikanyegeng, kgotsa o lemogile tiro e e sa letlelelweng.

1. Akhaonto ya Google (Personal Gmail & Google Workspace)¶

1. Bula sebatli mme o ye ka tlhamalalo kwa: https://myaccount.google.com/connections (kgotsa ya kwa myaccount.google.com -> tobetsa Tshireletso menyung wa molema -> tsamaisetsa kwa tlase go ya kwa Dikgolagano tsa gago le ditiriso le ditirelo tsa motho yo mongwe -> tobetsa Bona dikgolagano tsotlhe).
2. Tlhotlha ka Dikotsi: Tobetsa tšhipi ya setlhotlhi e e kwa godimo e e kwadilweng Access to your Google Account (e e tlhotlhang di-login tse di senang kotsi tsa "Saenela ka Google" tse di nang le leina fela le go tlhomolola ditiriso tse di nang le ditetlelelo tsa API tse di dirang tsa go bala Gmail ya gago, Google Drive, Khalendara, kgotsa Bagolagani).
3. Tobetsa tiriswa nngwe le nngwe e o sa e tlwaelang, e e belaetsang, kgotsa e e sa tlholeng e dirisiwa (ela tlhoko maina a a tsietsang a a etsisang ditiriso tsa tsamaiso tse di jaaka "Google Docs Viewer," "PDF Converter," "Email Cleaner," "eFax," kgotsa "Drive Backup").
4. Tsamaisetsa kwa tlase go ya kwa Bona dintlha go bona letlha le nako e e tlhomameng e go neng ga neelwa phitlhelelo ka yone le gore ke dikarolo dife (Gmail, Google Drive) e a tshwara.
5. Tobetsa Delete all connections you have with [App Name] -> Tobetsa Tlhomamisa.
6. Gape Phimola Dinako tsa Sediriswa se se Dirang (Tsa go Phisha Khoutu ya Sediriswa): Eya go https://myaccount.google.com/device-activity mme o tswe mo thulaganyong epe ya sediriswa sa Linux, Windows, Mac, kgotsa Smart TV se o sa se tlwaelang.

2. Ya Botho ya Microsoft (Outlook.com / Hotmail / Live / Xbox) kgatlhanong le Kgwebo (Microsoft 365 / Entra ID)¶

Microsoft e dirisa di-portal tse pedi tse di farologaneng go ikaegile ka gore a akhaonto ya gago ke akhaonto ya moreki wa gago kgotsa akhaonto ya tiro/ya sekolo:

A. Diakhaonto tsa Microsoft tsa Botho (@outlook.com, @hotmail.com, @live.com)¶

1. Eya ka tlhamalalo kwa go: https://account.live.com/consent/Manage (kgotsa ya kwa account.microsoft.com/privacy -> Ditiriso le ditirelo tse di kgonang go fitlhelela tshedimosetso ya gago).
2. Hlahloba kopo e nngwe le e nngwe e thathamisitsweng. Fa o bona tiriswa epe e o sa e lemogeng (kgotsa tlelaente e e utlwalang e le ya semolao jaaka eM Client, Thunderbird, kgotsa Mail App gore ga o ise o ko o e tsenye ka bowena, leano le le tlwaelegileng le le dirisiwang ke batlhasedi go bona dithokene tsa IMAP/Graph OAuth), tobetsa Edit ka fa tlase ga tiriswa eo o bo o tobetsa Remove these permissions.
3. Next, go to https://account.microsoft.com/security -> Manage how I sign in -> scroll down and click Sign me out (which forces a global invalidation across all browsers, apps, and Xbox/OneDrive sessions within 24 hours).

B. Corporate / Work / School Microsoft 365 & Microsoft Entra ID (Azure AD)¶

1. As an Individual Employee User:
2. Go to https://myapps.microsoft.com -> Click your profile icon or the gear icon -> Click Profile or click the three dots (...) on any unfamiliar app tile -> Select Manage your application -> Revoke permissions.
3. Also go to https://myaccount.microsoft.com -> Security info -> verify no rogue Authenticator app was added, and click Sign out everywhere under the Overview tab.
4. As a Microsoft 365 / Entra ID Administrator (Emergency PowerShell Token & Consent Purge): When an employee falls for OAuth Consent Phishing or Device Code Phishing in an enterprise tenant, simply deleting the app from the user's MyApps portal is not enough; an admin must revoke the OAuth2PermissionGrant across the tenant and invalidate the user's RefreshTokensValidFromDateTime via Microsoft Graph PowerShell:

# Connect to Microsoft Graph with Directory & Delegated Permission Grant Administrator privileges:
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All", "Application.ReadWrite.All"

# 1. Inspect all OAuth2 Delegated Permission Grants for the compromised user:
$User = Get-MgUser -UserId "victim@yourdomain.com"
Get-MgUserOauth2PermissionGrant -UserId $User.Id | Format-List Id, ClientId, ConsentType, Scope, ResourceId

# 2. Immediately delete the malicious OAuth2PermissionGrant by its Grant Id:
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<Grant-ID-From-Step-1>"

# 3. Remove the malicious Enterprise Application (ServicePrincipal) from the entire tenant so no other employee is affected:
Remove-MgServicePrincipal -ServicePrincipalId "<Malicious-ClientId-ObjectId>"

# 4. Revoke ALL active OAuth Refresh Tokens and Continuous Access Evaluation (CAE) sessions for the user immediately:
Revoke-MgUserSignInSession -UserId $User.Id

3. GitHub, Slack, Discord, Apple (Sign in with Apple), and X / Social Accounts¶

Attackers heavily target developer, community, and social accounts with OAuth phishing to push malicious code commits, drain Discord communities, or post cryptocurrency drainer links:

Phase 2: Hunting for secondary persistence left behind by the malicious OAuth app¶

1. Email Inbox Rules, Auto-Forwarders, and Hidden Sweep Rules (Gmail & Outlook / M365)¶

Fa tiriswa e e kotsi ya OAuth e ne e na le Mail.ReadWrite kgotsa MailboxSettings.ReadWrite ditetlelelo: * In Gmail: Click the Gear Icon (top right) -> See all settings. 1. Click the Forwarding and POP/IMAP tab -> Verify that Forwarding e setilwe go Thibela go fetisa mme ga go na aterese ya imeile e e sa tlwaelegang e e kwadilweng. 2. Click the Filters and Blocked Addresses thebo -> Batla setlhotlhi sengwe le sengwe se se tsamaelanang from:(*) kgotsa mafoko a botlhokwa jaaka bank, wire, invoice, coinbase, password, kgotsa security ka tiro Delete it, Skip the Inbox (Archive it), kgotsa Forward it to -> Phimola ditlhotlhi tseo ka bonako. 3. Click the Accounts and Import thebo -> Ka fa tlase ga Naya phitlhelelo ya akhaonto ya gago (Phitlhelelo e e abetsweng) le Romela poso jaaka, tlosa aterese epe e o sa e tlwaelang. * Mo Webong ya Maekerosofate ya Tebogo (outlook.office.com kgotsa outlook.live.com): Tobetsa Aekhone ya Kere (kwa godimo ka fa mojeng) -> Imeile. 1. Tobetsa Rules -> Phimola molao mongwe le mongwe o o sa o tlwaelang (batlhasedi gantsi ba bitsa melao e e kotsi . kgotsa ... kgotsa Security Sync and configure them to move incoming emails into the RSS Subscriptions kgotsa Conversation History foltara fa o ntse o di tshwaya jaaka Bala). 2. Tobetsa Forwarding (le Junk email) -> Make sure Enable forwarding is unchecked, and delete any attacker domain added to the Safe senders and domains list.

2. Cloud Drive Mass-Download Audit & "Link-Sharing" Backdoors (Google Drive & OneDrive / SharePoint)¶

Once an OAuth app has Files.ReadWrite.All kgotsa drive scope, it does two things: first, it downloads your sensitive PDFs, spreadsheets, and password files; second, it can silently change the sharing permissions on your confidential folders to "Anyone with the link can view/edit" so the attacker can still open those folders in an anonymous browser even after you revoke the OAuth app. * In Google Drive: Click the (i) View Details (Activity) icon in the top right corner to see every file viewed, modified, or shared in the last 7 days. Then type is:unorganized, sharedwith:public, kgotsa sharedwith:external into the top Google Drive search bar to find any files or folders the attacker made publicly accessible. * In Microsoft OneDrive: Go to the Shared -> Shared by you tab on the left menu and revoke any public link (Anyone with the link) you did not create.

3. Google Apps Script (script.google.com) & Microsoft Power Automate (make.powerautomate.com) Triggers¶

Here is a persistence trick used against Google and Microsoft 365 users: while inside your account, an attacker creates a 10-line Google Apps Script (at https://script.google.com/home/triggers) or a Microsoft Power Automate Cloud Flow (at https://make.powerautomate.com) set to run on a 5-minute timer (Time-driven trigger kgotsa When a new email arrives). Because that script runs natively inside your own cloud account, it keeps exfiltrating your emails every 5 minutes even after you change your password and delete external apps. * Bula https://script.google.com/home/triggers (for Google) or https://make.powerautomate.com -> My flows (for Microsoft 365) right now and delete any script or automated flow you did not personally write.

4. Auditing Cloud Audit Logs for Data Exfiltration (Google Takeout, Entra Sign-In Logs, & Unified Audit Log)¶

If you need to know exactly which emails or files the malicious OAuth application read or downloaded while its token was active: * On Personal Google Accounts: Open https://myactivity.google.com le https://myaccount.google.com/notifications to inspect recent security events and check whether a Google Takeout archive export was requested. * On Google Workspace (Admin Console): Go to admin.google.com -> Reporting -> Audit and investigation -> OAuth log events le Drive log events filtered by the compromised user and the malicious Client ID to get a complete timestamped list of every file ID accessed. * On Microsoft 365 (Purview / Entra ID): Open entra.microsoft.com -> Identity -> Monitoring & health -> Sign-in logs, tobetsa Non-interactive user sign-ins le Service principal sign-ins dithebo (dipegelo tsa go Tsena tse di tlwaelegileng tsa Tirisanommogo GA DI bontshe ditlhabololo tsa letshwao la OAuth la lemorago), le go tlhotlha ka tse di kotsi Application ID go bona aterese nngwe le nngwe ya IP le pitso ya motswedi e e dirilweng ke motlhasedi.

5. Go Dikolosa Diphiri Tse di Bonwang mo Teng ga Cloud Drive kgotsa Imeile ya Gago¶

Fa e le gore tiriswa e e kotsi ya OAuth e ne e kgona go tsena mo mabolokelong a gago a Gmail, Outlook, Google Drive, OneDrive, kgotsa GitHub le e leng metsotswana e le 60, tsaya gore motlhasedi o ne a dirisa sediriswa se se itirisang sa go tlhotlhora regex mo lebokosong la gago la poso le mo drive a batla: 1. Dipolelwana tsa Peo tsa Madi a Sephiri (12/24-word BIP-39 mnemonics) kgotsa Sepatšhe .json Keystores: Fa e le gore senepe kgotsa tokomane e e nang le polelo ya peo ya crypto e ne e le mo polatefomong ya gago ya kwa marung kgotsa mo imeileng, sutisetsa madi otlhe kwa peong e ntšha ya sepatšhe sa serweboleta ka bonako (bona Go tswa ga sepatšhe sa Cryptocurrency le go sa dumalane le polelo ya peo). 2. Taolo ya Nomoro ya Sephiri e e Rometsweng kwa ntle .csv Difaele kgotsa Dipoelo tsa Lekgetho (Form 1040 / W-2): Dikolosa dikhunololamoraba tsa gago mme o gatsetse dibiro tsa gago tsa sekoloto (Equifax, Experian, TransUnion) jaanong jaana. 3. Dinotlolo tsa API tsa Motlhabolodi (AWS_SECRET_ACCESS_KEY, Stripe, OpenAI, GitHub PATs, .env difaele): Phimola le go pitikolola sephiri sengwe le sengwe sa mafaratlhatlha a kwa marung se se kileng sa tlhagelela mo diimeileng tsa gago, melaetsa ya Slack, kgotsa mo ditokomaneng tsa kwa marung.

Lenaanenetefatso la thibelo: go emisa go tsietsa ga OAuth le Khoutu ya Sediriswa ruri¶

• Le ka motlha o se ke wa naya tiriswa e e tswang kwa ntle e e tletseng Read/Write Email kgotsa Full Cloud Drive ditetlelelo fela go leba PDF e le nngwe, taletso ya khalentara, kgotsa tiriso: Kgokagano e e kafa molaong ya go leba tokomane ga e ke e tlhoka tetla ya go "Bala, tlhama, romela, le go phimolela ruri imeile yotlhe ya gago mo Gmail." Fa sekerini sa tumelelo ya OAuth se se sa lebelelwang se kopa gore lebokoso la poso le le anameng le tswale di-tab ka bonako.
• Le ka motlha o se ke wa thaepa Device Login Code (microsoft.com/devicelogin kgotsa google.com/device) e e go rometsweng ke motho yo mongwe ka imeile, mokwalo, kgotsa motlotlo: Dikhoutu tsa sediriswa (RFC 8628) ke tsa diskrini tsa hardware fela tse di ntseng ka mmele fa pele ga gago mo phaposing e le nngwe (jaaka Apple TV ya gago ya phaposi ya bonno kgotsa theminale ya gago ya SSH). Fa motho yo mongwe a tlhagisa khoutu ya sediriswa mme a go kopa gore o e thaepe, o tsena mo khomphuteng ya bone mo akhaontong ya gago.
• Go Batsamaisi ba Lefelo la Tiro la Microsoft 365 / Google: Thibela Tumelelo ya Tiriswa ya OAuth ya Modirisi wa Bofelo le go Thibela Kelelo ya Khoutu ya Sediriswa ka Phitlhelelo ya Maemo:
• Mo Lefelo la Botsamaisi la Microsoft (entra.microsoft.com) -> Boitshupo -> Ditiriso -> Ditiriso tsa kgwebo -> Tumelelo le ditetlelelo -> Diseting tsa tumelelo ya modirisi, fetoga go tswa go Letla tumelelo ya modirisi ya ditiriso go ya go Do not allow user consent (mme o kgontshe Kelelo ya Tiro ya Tumelelo ya Motsamaisi gore badiri ba tobetse "Kopa Kamogelo" boemong jwa go naya ditiriso tsa boferefere phitlhelelo).
• Mo Khonsole ya Botsamaisi jwa Lefelotiro la Google (admin.google.com) -> Tshireletso -> Phitlhelelo le taolo ya tshedimosetso -> Ditaolo tsa API -> Laola Phitlhelelo ya Tiriswa ya Motho wa Boraro, seta dikoupu tse di kotsi thata (Gmail, Drive) go ya go Trusted: Can only access Google data if explicitly allowlisted by an admin.
• Tlhama Pholisi ya Phitlhelelo ya Entra ID e e thibelang Device Code Flow mokgwa wa phetiso ya netefatso bakeng sa basebedisi bohle bao e seng bahlahisi.

Dipotso tse di bodiwang kgapetsakgapetsa¶

Ke ka ntlha yang fa go fetola nomoro ya me ya sephiri le go tobetsa Netefatso ya Dintlha tse Pedi (2FA) go sa leleka tiriswa e e kotsi ya OAuth?¶

Di-password le Netefatso ya Dintlha tse Pedi di disa fela lebati la kwa pele fa motho a tsena ka sekerini sa go tsena. Fa o tobetsa `Allow` mo potso ya tumelelo ya OAuth 2.0, o laela Google, Microsoft, GitHub, kgotsa Discord go ntsha sephiri `Refresh Token` ka tlhamalalo go sefara eo ya tiriso ya motho yo mongwe gore tiriso e kgone go dira kwa morago fa o se mo inthaneteng. Ka moakanyetso wa boagi, dipolatefomo di le dintsi di letla dikopantsho tse di letleletsweng tsa motho yo mongwe (jaaka didirisiwa tsa go tsamaisanya khalentara, ditirelo tsa bekapo, kgotsa dikgokagano tsa CRM) go nna di dira mo diphetogong tsa nomoro ya sephiri tsa ka metlha ntle le fa o ya ka tlhamalalo mo tsebeng ya gago ya Dikgolagano tsa Tiriso ya Motho wa Boraro mme o tobetse **Phimola** / Tlosa.

Kgokagano ya go tsietsa ya OAuth e ka bontsha jang accounts.google.com kgotsa login.microsoftonline.com ka selotlolo sa nnete sa HTTPS fa e le gore e ne e le tsietso?¶

Mo tlhaselong ya Phishing ya Tumelelo ya OAuth, sekebekwa ga se tlhame webosaete ya maaka; go na le moo, ba kwadisa tiriswa ya mahala ya motlhabolodi mo teng ga Google Cloud kgotsa Microsoft Azure (e e tsayang metsotso e le 2) mme ba go romele kgokagano ya mmatota ya tetla ya Google kgotsa Microsoft e e nang le tiriswa ya bone . `client_id`. Ka gonne o etela sefara ya mmatota ya go tsena ya Google kgotsa ya Microsoft, leina la kgolagano ya dikhomphiutha le setifikeiti sa SSL ke tsa boammaaruri ka diperesente di le 100. Tsietso e mo go **ke mang yo e leng mong wa leina la app ya motho wa boraro** go kopa tetlelelo fa o sena go tsena; go tobetsa `Allow` e bolelela sefara ya mmatota ya Google kgotsa ya Microsoft go neela tshedimosetso ya gago kwa app e e kwadisitsweng ya motlhabolodi wa sekebekwa.

"Phishing ya Khoutu ya Sediriswa" ke eng (microsoft.com/devicelogin), mme ke eng fa e le kotsi jaana?¶

Thebolelo ya Thebolo ya Sediriswa sa OAuth 2.0 (`RFC 8628`) was created so you could sign into devices that do not have a web browser or keyboard, such as a Smart TV or command-line interface (CLI): the TV displays an 8-character code and tells you to open `microsoft.com/devicelogin` on your phone and enter that code. In a Device Code Phishing attack, a hacker runs a script (`TokenTactics` kgotsa `RoadTools`) on their own computer to generate a fresh 8-character code, then emails or messages you on Teams/Slack claiming you must enter that code at `microsoft.com/devicelogin` go leba tokomane e e sireletsegileng kgotsa go netefatsa akhaonto ya gago. La bobedi fa o thaepa khoutu ya bone mo saeteng ya mmatota ya Microsoft, Microsoft e tsenya khomphutha ya motlhasedi ka tlhamalalo mo akhaontong ya gago ka ditleleimi tse di feletseng tsa Netefatso ya Dintlha tse dintsi tse di setseng di kgotsofetse.

A "Saenela ka Google" kgotsa "Saenela ka Apple" e e tlwaelegileng e kotsi fa pop-up e kopa fela Leina la me le Aterese ya Imeile?¶

Kgolaganyo ya OpenID e e Tlwaelegileng (`OIDC`) "Saenela go tsena ka Google / Apple / Microsoft" e go rotloetsa gore **fela** o kope porofaele ya gago ya motheo (`Name`, `Email address`, le `Profile picture`) tota di babalesegile thata go na le go thaepa nomoro ya sephiri mo webosaeteng e ntšha, ka gonne webosaete ya motho yo mongwe ga e ke e bona nomoro ya gago ya sephiri mme ga e kgone go bona diimeile kgotsa difaele tsa gago. Kotsi e diragala fela fa pop-up ya tumelelo e kopa **dikokoupo tse dingwe tse di botlhokwa tsa API**, tse di jaaka *"Bala, tlhama, romela, le go phimolela ruri imeile yotlhe ya gago,"* *"Bona, tseleganya, tlhama, le go phimola difaele tsotlhe tsa gago tsa Google Drive,"* kgotsa *"Kopanela le disefara tsa gago pele ga o tobetsa sekirini sa go romela."

Dikaedi tse di tsamaelanang¶

• Go tsietsa ga MFA le go tlola Mmaba-mo-Gareng (AiTM)
• Go tseelwa dikhuki tsa nako ka dikgoka, serweboleta se se kotsi sa infostealer, le go phimolwa ga selotlolo sa sephiri
• Akhaonto ya imeile e thubilwe: melao ya go fetisa le go busetsa
• Go Senya Imeile ya Kgwebo ya Kgwebo (BEC) le go busediwa gape ga tsietso ya mogala
• Dikatoloso tsa sebatli tse di kotsi, di-hijack tsa clipboard, le go tlosiwa ga serweboleta sa papatso
• Dinomoro tsa tshoganyetso tsa lefatshe lotlhe

Metswedi e tlhotlhomisitswe¶

• Setheo sa Tshireletsego ya Inthanete le Tshireletsego ya Mafaratlhatlha (CISA) & Biro ya Bosetšhaba ya Dipatlisiso (FBI) (United States): Kgakololo e e Kopanetsweng ya Tshireletsego ya Inthanete ka ga Dithuso tsa Tumelelo ya OAuth tse di seng Molaong, Go Tsenya Khoutu ya Sediriswa (RFC 8628), le Bogodu jwa Letshwao la Boitshupo jwa Leru.
• Setlhopha sa Tiro sa Boenjenere jwa Inthanete (IETF) (Boditšhabatšhaba): RFC 6749 (Letlhomeso la Thebolo ya OAuth 2.0), RFC 7009 (Phimolo ya Letshwao la OAuth 2.0), le RFC 8628 (Tshireletso ya Thebolelo ya Thebolo ya Sediriswa sa OAuth 2.0).
• Botlhale jwa Matshosetsi a Microsoft le Boenjenere jwa Tshireletsego ya Microsoft Entra (Boditšhabatšhaba): Buka ya go Tshameka ya go Tsibogela Ditiragalo tsa Ditiriso tsa OAuth tse di Kotsi (OAuth2PermissionGrant) le go Tsenya Khoutu ya Sediriswa mo ID ya Microsoft Entra.
• Google Cloud & Tshireletso ya Lefelo la Tiro la Google (Boditšhabatšhaba): Netefatso ya Bogolo jwa API ya OAuth 2.0, Puso ya Phitlhelelo ya Tiriswa ya Motho yo mongwe, le Thulaganyo ya go Phimola Letshwao.
• Setsi sa Bosetšhaba sa Tshireletso ya Inthanete (NCSC) (Bogosi jo bo Kopaneng): Kaelo ya go Sireletsa Bahiri ba kwa Marung Kgatlhanong le go Tsenya Batho ka Tumelelo ya OAuth le Tiriso e e sa Siamang ya API e e Rometsweng.