Imvume ye-OAuth yobugebengu bokweba imininingwane ebucayi futhi Ihoxisa Izimvume Zohlelo Lokusebenza Lwenkampani Yangaphandle ezinonya¶

Cabanga nje uthola ukuthi umhlaseli ufunda ama-imeyili akho ayimfihlo, ulanda amadokhumenti akho efu, udala imithetho yokudlulisa ibhokisi lemiyalezo engenayo buthule, noma uthumela izixhumanisi zomkhonyovu ku-akhawunti yakho, NOMA NGEMVA kokuthi usanda kushintsha iphasiwedi yakho yaba iyunithi yezinhlamvu engahleliwe enezinhlamvu ezingu-24 futhi isebenze i-hardware ye-Two-Factor Authentication (2FA / Passkeys). Ngabe umhlaseli usangaphakathi kanjani ku-akhawunti yakho ye-Google Workspace, Microsoft 365, GitHub, Slack, noma Discord ngaphandle kokwazi iphasiwedi yakho entsha noma ukuqalisa ukwaziswa okukodwa kwe-2FA? Ngoba ube yisisulu se-OAuth 2.0 Consent Phishing (owaziwa nangokuthi Imvume Yemvume Engekho emthethweni noma Ubugebengu Bokweba imininingwane ebucayi). Esikhundleni sokukukhohlisa ukuthi uthayiphe igama-mfihlo lakho ekhasini lokungena elingelona iqiniso, umhlaseli ukuthumele isixhumanisi esiya kweqiniso. accounts.google.com noma login.microsoftonline.com isikrini sokugunyaza esibuza ukuthi uhlelo lokusebenza luqanjwe igama "PDF Document Viewer," "eSign Security Check," "Zoom Meeting Recorder," noma "Mail Backup Assistant" ingase ibe nemvume "Yokufunda, ukubhala, ukuthumela, nokususa unomphela yonke i-imeyili yakho ku-Gmail" noma "Yiba nokufinyelela okugcwele kuwo wonke amafayela onokufinyelela kuwo."

Ngesikhathi uchofoza Allow noma Accept kulelo bhokisi langempela le-Microsoft noma le-Google, umhlinzeki wobunikazi ukhiphe iseva yomhlaseli i-cryptographic ehlala isikhathi eside OAuth Refresh Token (offline_access). Ngoba amathokheni e-OAuth 2.0 API afakazela ubuqiniso ngokuqondile ngokumelene ne-backend REST/Graph APIs (graph.microsoft.com noma gmail.googleapis.com) ngaphandle kokuphazanyiswa ngokuphelele neseshini yakho yewebhu yomuntu, ukushintsha iphasiwedi yakho noma ukungeza i-2FA ngokuvamile kushiya izibonelelo zohlelo lokusebenza lwezinkampani zangaphandle ezinonya zisebenza ngamaphesenti angu-100. Ukuze ukhiyele umhlaseli ngaphandle kukuhle, kufanele uhoxise mathupha ukunikezwa kwesicelo senkampani yangaphandle, ubulale wonke amathokheni okuvuselela e-OAuth akhishiwe kanye namathokheni okufinyelela, futhi ukhiphe noma yiziphi izizinda zangemuva ezidalwe uhlelo lokusebenza ngenkathi lufinyelela i-API.

Yenza lokhu manje¶

1. ** Qonda ngokushesha ukuthi kungani ukushintsha iphasiwedi yakho AKUMANGALISI isigebengu se-inthanethi: kufanele uhoxise Third-Party App / OAuth Consent Grant ngaphakathi kwephothali yezokuphepha ye-akhawunti yakho.** Uma uchofoza Allow esikrinini se-OAuth, udala inkontileka ye-API yomshini uye emshinini eqhubekayo (Service Principal / OAuth App Token). Iya ngqo ekhasini lomhlinzeki wakho elithi Izinhlelo Zokusebenza Nezinkonzo Zenkampani Yangaphandle khona manje (myaccount.google.com/connections okwe-Google, myapps.microsoft.com noma account.live.com/consent/Manage yeMicrosoft, github.com/settings/applications ye-GitHub) bese uchofoza okuthi Susa Ukufinyelela / Hoxisa kulo lonke uhlelo lokusebenza ongalazi futhi ongalethembi ngamaphesenti angu-100.
2. **Uma uthayiphe kukho ikhodi yezinhlamvu nezinombolo eziyizinhlamvu ezingu-8 noma-9 microsoft.com/devicelogin, google.com/device, noma github.com/login/device ngesikhathi socingo lobugebengu bokweba imininingwane ebucayi noma ingxoxo, chitha kokubili kwakho Active Device Sessions KANYE OAuth App Grants ngokushesha.**Ekuhlaseleni Kwekhodi Yedivayisi Okugeleza Kobugebengu Bokweba imininingwane ebucayi (RFC 8628), umhlaseli ukhiqiza ikhodi yokumatanisa ye-smart-TV/CLI kukhompuyutha yakhe futhi akukhohlise ukuthi uthayiphe leyo khodi eqinisweni. microsoft.com/devicelogin ikhasi. Ukuthayipha leyo khodi kunika umhlaseli isisekelo Refresh Token (PRT / Multi-Resource Refresh Token) ezifihlwe njenge-Microsoft Office, i-Azure CLI, noma iklayenti le-Apple Internet Accounts.
3. Ngemva kokuhoxisa uhlelo lokusebenza lwe-OAuth olunonya, cwaninga ngokushesha I-imeyili yakho Forwarding Rules, Inbox Filters, futhi Delegated Mailbox Access nge-UI ye-Graph/Gmail. Iyiphi into yokuqala ngqa eyenziwa uhlelo lwe-OAuth olunonya ekuqaleni? 500 milliseconds ngemva kokuchofoza Allow? Isebenzisa i- Mail.ReadWrite noma MailboxSettings.ReadWrite I-API scope yokujova umthetho ongabonakali webhokisi lemiyalezo engenayo leseva elidlulisela ngokuzenzakalela wonke amabhange angenayo, i-crypto, noma i-imeyili yokusetha kabusha iphasiwedi kumhlaseli futhi imizila iphendula ngqo kwakho. Trash noma RSS Feeds ifolda (bona I-akhawunti ye-imeyili intshontshiwe: imithetho yokudlulisela phambili nokutholwa).
4. Hlola ukuthi ingabe uhlelo lokusebenza lwe-OAuth olunonya lubhalise uhlelo lwesibili lwe-OAuth eyisipele, i-Personal Access Token (PAT), Ukhiye we-SSH, noma indlela ye-MFA ngenkathi inezinhlelo zokulawula. Ku-Microsoft Entra ID (Azure AD), GitHub, ne-Google Workspace, inkomba enikezwe uhlelo lokusebenza noma izikophu zokuphatha i-akhawunti (Application.ReadWrite.All, RoleManagement.ReadWrite.Directory, noma i-GitHub admin:public_key) ingakha buthule ithokheni ye-API yesibili efihliwe noma inhloko yesevisi ukuze umhlaseli agcine ukufinyelela ngemva kokususa uhlelo lokusebenza lokuqala.
5. Uma lokhu kwenzeka ebhizinisini noma esikoleni Microsoft 365 noma Google Workspace shayela i-IT Security / SOC Helpdesk yakho phakathi nemizuzu engu-5. Umsebenzi oyedwa uyachofoza Accept kusixhumanisi sobugebengu bokweba imininingwane ebucayi se-OAuth singanikeza umhlaseli ukufinyelela kokufunda kuyo yonke inkampani SharePoint, OneDrive, Teams chats, and Global Address List, kwethula i-Business Email Compromise yangaphakathi (BEC) ukuhlaselwa komgunyathi ngocingo kosebenza nabo kanye namakhasimende.
6. Uma umhlaseli esebenzise ukufinyelela kwe-OAuth ukuze abuke amadrayivu akho amafu (Google Drive / OneDrive), izimbuyiselo zentela, ukuthunyelwa kwephasiwedi, noma izitatimende zezimali, vala amafayela akho esikweletu futhi uvale ama-akhawunti ezezimali. Uma omazisi ababucayi noma amabinzana ezinhlamvu angabetheliwe/amaphasiwedi agcinwe kudrayivu yefu efinyelelwe uhlelo lokusebenza lwe-OAuth, phatha wonke amafayela akuleyo drayivu njengoba alandwe umhlaseli (bona Impendulo yokwephulwa kwedatha nokuvuza kwephasiwedi).

flowchart TD
    A["Okusolwayo Kwemvume ye-OAuth Ubugebengu Bokweba imininingwane ebucayi noma Ukungenwa Kwe-akhawunti Okuphikelelayo Ngemva Kokusetha Kabusha Iphasiwedi"] --> B["1. Vula Iphothali Yezimvume Zohlelo Lokusebenza Lwenkampani Yangaphandle (I-Google Connections / Microsoft MyApps / GitHub Application)"]
    B --> C["2. Thatha isithombe-skrini izinhlelo zokusebenza ezingajwayelekile ukuze uthole ubufakazi, bese uchofoza okuthi 'Hoxisa / Susa Ukufinyelela' kulo lonke uhlelo lwe-OAuth olusolisayo."]
    C --> D{"Ingabe ufake ikhodi ekhasini lokungena ngemvume kwedivayisi (isb., microsoft.com/devicelogin)?"}
    D -->|"Yebo: Ubugebengu Bokweba imininingwane ebucayi (RFC 8628)"| E["Khipha okuthi 'Phuma Kuyo Yonke Indawo / Uhoxise Wonke Amathokheni Okuvuselela' ukuze ubulale izikhathi zomdabu ze-CLI / Ikhodi Yedivayisi"]
    D -->|"Cha: I-Standard Web OAuth Grant"| E
    E --> F["3. Hlola futhi Usule Iminyango Engemuva Yesibili Edalwe Ithokheni ye-API"]
    F --> G["Hlola Imithetho Yebhokisi Lemilayezo Engenayo, Ukudlulisela Ngokuzenzakalelayo, Nokufinyelela Okuthunyelwe (I-Gmail / Outlook)"]
    F --> H["Hlola amathokheni okufinyelela komuntu siqu kanjiniyela (ama-PAT), okhiye be-SSH, nokuhlanganiswa kwe-Webhook"]
    F --> I{"Ingabe le bekuyi-Akhawunti Yebhizinisi ye-Microsoft 365 / Google Workspace?"}
    I -->|"Yebo"| J["Yazisa Umphathi Webhizinisi / I-SOC ngokushesha ukuze uhoxise Isibonelelo Sikahulumeni Sesevisi Ku-ID Yokungena / Umphathi Wendawo Yokusebenzela"]
    I -->|"Cha (I-akhawunti Yomuntu Siqu)"| K["Shintsha iphasiwedi + Qinisekisa amadivayisi we-MFA + Hlola Amalogi Wokulanda Umsebenzi We-Cloud Drive"]

Indlela i-OAuth 2.0 Consent Phishing edlula ngayo amaphasiwedi kanye ne-2FA (Technical Anatomy)¶

Kungani kube nama-cybercriminal syndicates, amaqembu ezinhloli zezwe (Midnight Blizzard, Star Blizzard), kanye nama-drainer e-cryptocurrency ashintshe kakhulu kusukela ebugebengwini bokungena ngemvume obuvamile ukuya kokuthi Imvume ye-OAuth Ubugebengu Bokweba imininingwane ebucayi kanye nokuthi Ubugebengu Bokweba imininingwane ebucayi?

1. Ubugebengu Bokweba imininingwane ebucayi ngokumelene nobugebengu bokweba imininingwane ebucayi be-OAuth ngokumelene nobugebengu bokweba imininingwane ebucayi¶

2. Isicelo Sezikophu Zemvume Ye-OAuth Eyingozi Ephezulu¶

Uma uhlola uhlelo lokusebenza ohlwini lwakho lwezimvume, bhekisisa izikophu olucelile: * Igrafu yeMicrosoft (Entra ID / Microsoft 365 / Outlook.com): * Mail.Read, Mail.ReadWrite, Mail.Send, MailboxSettings.ReadWrite (Ivumela ukufunda wonke ama-imeyili, ukuthumela ama-imeyili njengawe, nokudala imithetho efihliwe yokudlulisela ibhokisi lemilayezo engenayo). * Files.Read.All, Files.ReadWrite.All, Sites.ReadWrite.All (Ivumela ukulanda wonke amafayela ku-OneDrive yakho kanye nayo yonke ifolda ye-SharePoint yebhizinisi eyabelwe). * offline_access (Ivumela iseva yomhlaseli ukuthi imise amathokheni okufinyelela amasha buthule 24/7 nanoma ikhompyutha yakho ivaliwe). * Directory.ReadWrite.All, AppRoleAssignment.ReadWrite.All, User.ReadWrite.All (Izikophu zokukhuphuka kwelungelo lebhizinisi eliyinhlekelele). * I-Google Workspace / Personal Gmail (Google APIs): * https://mail.google.com/ noma gmail.modify / gmail.settings.basic / gmail.settings.sharing (Ukulawula okugcwele kokufunda, ukususa, nokudlulisa i-Gmail). * https://www.googleapis.com/auth/drive (Ukufinyelela okugcwele kokufunda/ukubhala/ukulanda kuwo wonke amafayela ku-Google Drayivu yakho). * https://www.googleapis.com/auth/cloud-platform (Ukulawula okugcwele nengqalasizinda ye-Google Cloud kanye nenkokhelo). * I-GitHub & Developer Ecosystems (GitHub Apps / OAuth Apps): * repo futhi workflow (Ukufinyelela okugcwele kokufunda/okubhala kuwo wonke amaqoqo ekhodi yomthombo ayimfihlo kanye nemvume yokujova amapayipi okweba izimfihlo ze-GitHub CI/CD). * admin:org, admin:public_key, futhi admin:gpg_key (Imvume yokwengeza okhiye be-SSH be-backdoor abaphikelelayo noma ukuguqula ubulungu benhlangano). * I-Slack & Discord OAuth Scopes: * Ukunethezeka channels:history, groups:history, im:history, files:read, futhi chat:write (Ivumela uhlelo lokusebenza langaphandle ukuthi lifunde yonke imilayezo eqondile yeqembu eliyimfihlo, lisuse ama-PDF alayishiwe nemininingwane, futhi lithumele izixhumanisi zobugebengu bokweba imininingwane ebucayi uzenza isisebenzi esikanye nawe esimethembayo). * Ukungezwani guilds.join futhi identify (Ivumela i-bot esengozini noma iphothali yokuqinisekisa ukuthi ijoyine ngenkani i-akhawunti yakho ye-Discord kumaseva omkhonyovu ngokuphindaphindiwe ngaphandle kwemvume yakho).

Isigaba 1: Isinyathelo ngesinyathelo i-OAuth & Ukuhoxiswa kohlelo lokusebenza lwenkampani yangaphandle kuyo yonke ingxenyekazi enkulu¶

Landela lezi zinyathelo ezingezansi kuwo wonke ama-akhawunti lapho uchofoze khona isixhumanisi esisolisayo, esisetshenziswe "Ngena ngemvume nge-Google / Microsoft / Apple / GitHub / Discord" kusayithi elingathenjwa, noma uqaphele umsebenzi ongagunyaziwe.

1. I-Akhawunti ye-Google (Personal Gmail & Google Workspace)¶

1. Vula isiphequluli bese uya ngqo ku: https://myaccount.google.com/connections (noma uye ku myaccount.google.com -> chofoza Ukuphepha kumenyu engakwesokunxele -> skrolela phansi kokuthi Izixhumanisi zakho ezinhlelweni zokusebenza namasevisi ezinkampani zangaphandle -> chofoza Bona konke ukuxhumana).
2. Hlunga Ngengozi: Chofoza i-chip yesihlungi phezulu enelebula Access to your Google Account (ehlunga ukungena ngemvume okungenabungozi kokuthi "Ngena ngemvume nge-Google" futhi igqamise izinhlelo zokusebenza ezinezimvume ze-API ezisebenzayo zokufunda i-Gmail yakho, i-Google Drayivu, Ikhalenda, noma Oxhumana nabo).
3. Chofoza lonke uhlelo lokusebenza olungajwayelekile, olusolisayo, noma olungasasetshenziswa (qaphela amagama anenkohliso alingisa izinsiza zesistimu njenge "Google Docs Viewer," "PDF Converter," "Email Cleaner," "eFax," noma "Drive Backup").
4. Skrolela phansi kokuthi Bona imininingwane ukuze ubone usuku oluqondile nesikhathi okuvunyelwene ngalo nokuthi yiziphi izikophu (Gmail, Google Drive) ibamba.
5. Chofoza Delete all connections you have with [App Name] -> Chofoza okuthi Qinisekisa.
6. Futhi Hoxisa Izikhathi Zedivayisi Esebenzayo (Ngobugebengu Bokweba Imininingwane Yedivayisi): Iya kokuthi https://myaccount.google.com/device-activity futhi uphume ngemvume kunoma iyiphi iseshini yedivayisi ye-Linux, Windows, Mac, noma i-Smart TV engayijwayele.

2. I-Microsoft Personal (Outlook.com / Hotmail / Live / Xbox) vs. Ibhizinisi (Microsoft 365 / Entra ID)¶

I-Microsoft isebenzisa amaphothali amabili ahlukene kuye ngokuthi i-akhawunti yakho iyi-akhawunti yomuntu siqu yomthengi noma i-akhawunti yomsebenzi/yesikole:

A. Ama-Akhawunti Omuntu Ka-Microsoft (@outlook.com, @hotmail.com, @live.com)¶

1. Iya ngqo ku: https://account.live.com/consent/Manage (noma uye ku account.microsoft.com/privacy -> Izinhlelo zokusebenza namasevisi angafinyelela idatha yakho).
2. Hlola zonke izinhlelo zokusebenza ezisohlwini. Uma ubona noma yiluphi uhlelo lokusebenza ongalazi (noma iklayenti elizwakalayo elisemthethweni njenge eM Client, Thunderbird, noma Mail App ongakaze uzifake, iqhinga elivamile elisetshenziswa abahlaseli ukuthola amathokheni e-IMAP/Graph OAuth), chofoza Edit ngaphansi kwalolo hlelo lokusebenza bese uchofoza Remove these permissions.
3. Okulandelayo, hamba ku-https://account.microsoft.com/security* -> Phatha ukuthi ngingena kanjani ngemvume -> skrolela phansi bese uchofoza Sign me out (okuphoqa ukungasebenzi emhlabeni wonke kuzo zonke iziphequluli, izinhlelo zokusebenza, namaseshini e-Xbox/OneDrive phakathi kwamahora angu-24).

B. Ibhizinisi / Umsebenzi / Isikole Microsoft 365 & Microsoft Entra ID (Azure AD)¶

1. ** Njengomsebenzisi Oyedwa Oyisisebenzi:**
2. Iya ku https://myapps.microsoft.com -> Chofoza isithonjana sephrofayela yakho noma isithonjana segiya -> Chofoza Iphrofayela noma chofoza amachashazi amathathu (...) kunoma iliphi ithayela lohlelo lokusebenza olungajwayelekile -> Khetha okuthi Phatha uhlelo lwakho lokusebenza -> Hoxisa izimvume.
3. Iya futhi ku-https://myaccount.microsoft.com -> Ulwazi lokuvikeleka -> qinisekisa ukuthi alukho uhlelo lokusebenza Lokufakazela ubuqiniso oluqinile olungeziwe, bese uchofoza Sign out everywhere ngaphansi kwethebhu yokubuka konke.
4. NjengeMicrosoft 365 / Entra ID Administrator (Ithokheni ye-Emergency PowerShell & Ukuhlanzwa Kwemvume): Uma isisebenzi siwela ngenxa yobugebengu bokweba imininingwane ebucayi ye-OAuth noma Ubugebengu Bokweba imininingwane ebucayi kusiqashi sebhizinisi, ukususa uhlelo lokusebenza kuphothali yomsebenzisi ye-MyApps akwanele; umlawuli kumele ahoxise i OAuth2PermissionGrant kumqashi futhi wenze okomsebenzisi angasebenzi RefreshTokensValidFromDateTime nge-Microsoft Graph PowerShell:

# Connect to Microsoft Graph with Directory & Delegated Permission Grant Administrator privileges:
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All", "Application.ReadWrite.All"

# 1. Inspect all OAuth2 Delegated Permission Grants for the compromised user:
$User = Get-MgUser -UserId "victim@yourdomain.com"
Get-MgUserOauth2PermissionGrant -UserId $User.Id | Format-List Id, ClientId, ConsentType, Scope, ResourceId

# 2. Immediately delete the malicious OAuth2PermissionGrant by its Grant Id:
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId "<Grant-ID-From-Step-1>"

# 3. Remove the malicious Enterprise Application (ServicePrincipal) from the entire tenant so no other employee is affected:
Remove-MgServicePrincipal -ServicePrincipalId "<Malicious-ClientId-ObjectId>"

# 4. Revoke ALL active OAuth Refresh Tokens and Continuous Access Evaluation (CAE) sessions for the user immediately:
Revoke-MgUserSignInSession -UserId $User.Id

3. GitHub, Slack, Discord, Apple (Sign in with Apple), kanye nama-akhawunti we-X / Social¶

Abahlaseli baqondise kakhulu kunjiniyela, ama-akhawunti omphakathi, kanye nama-akhawunti omphakathi anobugebengu bokweba imininingwane ebucayi be-OAuth ukuze baphushe izenzo zamakhodi anonya, baqede imiphakathi ye-Discord, noma bathumele izixhumanisi zokudonsa imali ye-cryptocurrency:

Isigaba sesi-2: Ukuzingela ukuphikelela kwesibili okushiywe uhlelo lokusebenza lwe-OAuth olunonya¶

1. Imithetho Yebhokisi Lemilayezo Engenayo, Izidluliseli Ezizenzakalelayo, kanye Nemithetho Yokushanela Efihliwe (Gmail & Outlook / M365)¶

Uma ngabe uhlelo lokusebenza lwe-OAuth olunonya benalo Mail.ReadWrite noma MailboxSettings.ReadWrite izimvume: * Ku-Gmail: Chofoza Isithonjana Segiya (phezulu kwesokudla) -> Bona zonke izilungiselelo. 1. Chofoza inkinobho Forwarding and POP/IMAP ithebhu -> Qinisekisa lokho Forwarding isethwe ukuze ithi Khubaza ukudlulisela futhi alikho ikheli le-imeyili elingajwayelekile elisohlwini. 2. Chofoza inkinobho Filters and Blocked Addresses ithebhu -> Bheka noma yisiphi isihlungi esifanayo from:(*) noma amagama angukhiye afana bank, wire, invoice, coinbase, password, noma security ngesenzo Delete it, Skip the Inbox (Archive it), noma Forward it to -> Susa lezo zihlungi ngokushesha. 3. Chofoza inkinobho Accounts and Import ithebhu -> Ngaphansi kokuthi Nikeza ukufinyelela ku-akhawunti yakho (Ukufinyelela okuthunyiwe) kanye nokuthi Thumela imeyili njengo, susa noma yiliphi ikheli ongalazi. * Kuwebhu ye-Microsoft Outlook (outlook.office.com noma outlook.live.com): Chofoza Isithonjana Segiya (phezulu kwesokudla) -> Imeyili. 1. Chofoza Rules -> Susa yonke imithetho engajwayelekile (abahlaseli bavamise ukuqamba imithetho enonya . noma ... noma Security Sync futhi uwalungiselele ukuhambisa ama-imeyili angenayo ku- RSS Subscriptions noma Conversation History ifolda ngenkathi uwamaka njengeziFundiwe). 2. Chofoza Forwarding (futhi Junk email) -> Qiniseka ukuthi Ukunika amandla ukudlulisela akuhloliwe, futhi ususe noma isiphi isizinda somhlaseli esingezwe ohlwini lwe-Abathumeli abaphephile nezizinda.

2. Cloud Drive Mass-Download Audit & "Link-Sharing" Backdoors (Google Drive & OneDrive / SharePoint)¶

Uma sekukhona uhlelo lokusebenza lwe-OAuth Files.ReadWrite.All noma drive ububanzi, yenza izinto ezimbili: okokuqala, ilanda ama-PDF akho abucayi, amaspredishithi, namafayela ephasiwedi; okwesibili, ingashintsha buthule izimvume zokwabelana kumafolda akho ayimfihlo abe "Anyone with the link can view/edit" ukuze umhlaseli akwazi ukuvula lawo mafolda esipheqululini esingaziwa ngisho nangemva kokuhoxisa uhlelo lokusebenza lwe-OAuth. * Ku-Google Drayivu: Chofoza okuthi (i) Buka isithonjana semininingwane (Umsebenzi) ekhoneni eliphezulu kwesokudla ukuze ubone wonke amafayela abukiwe, alungisiwe, noma abiwe kulezi zinsuku ezingu-7 ezidlule. Bese uthayipha is:unorganized, sharedwith:public, noma sharedwith:external kubha yokusesha ephezulu ye-Google Drayivu ukuze uthole noma yimaphi amafayela noma amafolda umhlaseli awenze afinyeleleka esidlangalaleni. * Ku-Microsoft OneDrive: Yiya kuthebhu ethi Kwabiwe -> Okwabiwe nguwe kumenyu engakwesokunxele bese uhoxisa noma yisiphi isixhumanisi esisesidlangalaleni (Anyone with the link) awuzange udale.

3. I-Google Apps Script (script.google.com) kanye ne-Microsoft Power Automate (make.powerautomate.com) Izibangeli¶

Nali iqhinga lokuphikelela elisetshenziswa kubasebenzisi be-Google ne-Microsoft 365: ngenkathi ungaphakathi kwe-akhawunti yakho, umhlaseli udala imigqa engu-10 I-Google Apps Script (at https://script.google.com/home/triggers) noma Microsoft Power Automate Cloud Flow (ku https://make.powerautomate.com) isethwe ukuthi isebenze ngesibali sikhathi esiyimizuzu emi-5 (Time-driven trigger noma When a new email arrives). Ngoba leso skripthi sisebenza ngokwendalo ngaphakathi kwe-akhawunti yakho yefu, sihlala sikhipha ama-imeyili akho njalo ngemizuzu emi-5 noma usushintshe iphasiwedi yakho futhi ususa izinhlelo zokusebenza zangaphandle. * Vula https://script.google.com/home/triggers (ye-Google) noma https://make.powerautomate.com -> Ukugeleza kwami (kweMicrosoft 365) njengamanje bese ususa noma isiphi iskripthi noma ukugeleza okuzenzakalelayo ongazange ukubhale wena mathupha.

4. Ukuhlola Amalogi Okuhlola Amafu Wokuhluzwa Kwedatha (Google Takeout, Entra Sign-In Logs, & Unified Audit Log)¶

Uma udinga ukwazi kahle ukuthi yimaphi ama-imeyili noma amafayela uhlelo lwe-OAuth oluyingozi olufundiwe noma olulandiwe ngenkathi ithokheni yalo lisasebenza: * Kuma-Akhawunti Omuntu Ka-Google: Vula https://myactivity.google.com futhi https://myaccount.google.com/notifications ukuze uhlole imicimbi yakamuva yezokuphepha futhi uhlole ukuthi ukuthunyelwa kwengobo yomlando ye-Google Takeout bekuceliwe yini. * Ku-Google Workspace (Ikhonsoli Yomqondisi): Iya kokuthi admin.google.com -> Reporting -> Audit and investigation -> OAuth log events futhi Drive log events ihlungwe umsebenzisi owonakele kanye ononya Client ID ukuze uthole uhlu oluphelele olufakwe isitembu sesikhathi sawo wonke ama-ID wefayela afinyelelwe. * Ku-Microsoft 365 (Purview / Entra ID): Vula entra.microsoft.com -> Identity -> Monitoring & health -> Sign-in logs, chofoza inkinobho Non-interactive user sign-ins futhi Service principal sign-ins amathebhu (amalogi ajwayelekile Okungena Ngemvume Okusebenzisanayo awabonisi ukuvuselelwa kwamathokheni e-OAuth), futhi ahlunge ngonya Application ID ukuze ubone lonke ikheli le-IP kanye nekholi yesisetshenziswa eyenziwe umhlaseli.

5. Ukuzungezisa Izimfihlo Ezidaluliwe Zitholwe Ngaphakathi Kwedrayivu Yakho Yefu noma I-imeyili¶

Uma uhlelo lokusebenza lwe-OAuth olunonya belukwazi ukufinyelela amakhosombe akho e-Gmail, Outlook, Google Drive, OneDrive, noma GitHub ngisho namasekhondi angu-60, cabanga ukuthi umhlaseli ugijime i-regex scraper ezenzakalelayo kulo lonke ibhokisi lakho lemeyili futhi washayela efuna: 1. Cryptocurrency Seed Phrases (12/24-word BIP-39 mnemonics) noma Isikhwama .json Izitolo ezingukhiye: Uma isithombe noma idokhumenti equkethe ibinzana lezinhlamvu ze-crypto ibiku-cloud drive yakho noma i-imeyili, hambisa zonke izimali kumbewu yesikhwama sehadiwe entsha ngokushesha (bona I-Cryptocurrency wallet drain kanye nenkulumo yembewu isengozini). 2. Isiphathi Sephasiwedi Sithekelisiwe .csv Amafayela noma Izimbuyiselo Zentela (Form 1040 / W-2): Jikelezisa amagama ayimfihlo futhi umise ama-credit bureaus (Equifax, Experian, TransUnion) ngokushesha. 3. Okhiye be-API kanjiniyela (AWS_SECRET_ACCESS_KEY, Stripe, OpenAI, GitHub PATs, .env amafayela): Hoxisa futhi ugoqe yonke imfihlo yengqalasizinda yefu eyake yavela kuma-imeyili akho, imilayezo ye-Slack, noma amadokhumenti wamafu.

Uhlu lokuhlola lokuvimbela: ukumisa ubugebengu bokweba imininingwane ebucayi be-OAuth kanye Nekhodi Yedivayisi unomphela¶

• Ungalokothi unikeze uhlelo lokusebenza lwangaphandle olugcwele Read/Write Email noma Full Cloud Drive izimvume ukuze nje ubuke i-PDF eyodwa, isimemo sekhalenda, noma insiza: Isixhumanisi esisemthethweni sokubuka idokhumenti asilokothi sidinge imvume "Funda, bhala, uthumele, futhi ususe unomphela yonke i-imeyili yakho ku-Gmail." Uma isikrini semvume ye-OAuth esingalindelekile sicela ibhokisi leposi elibanzi noma izikophu zokushayela, vala ithebhu ngokushesha.
• Ungalokothi uthayiphe u-a Device Login Code (microsoft.com/devicelogin noma google.com/device) ithunyelwe kuwe ngomunye umuntu nge-imeyili, umbhalo, noma ingxoxo: Amakhodi edivayisi (RFC 8628) ezezikrini zehadiwe ezihlezi ngokomzimba phambi kwakho ekamelweni elilodwa (njengegumbi lakho lokuhlala i-Apple TV noma itheminali yakho ye-SSH). Uma omunye umuntu akhiqiza ikhodi yedivayisi futhi ekucela ukuthi uyithayiphe, ufaka ikhompyutha yakhe ku-akhawunti yakho*.
• KuMicrosoft 365 / Google Workspace Admins: Khubaza Imvume Yohlelo Lokusebenza Lwe-OAuth Yomsebenzisi Wokugcina futhi Vimba Ukugeleza Kwekhodi Yedivayisi Ngokufinyelela Okunemibandela:
• Ku Microsoft Entra Admin Center (entra.microsoft.com) -> Ubunikazi -> Izinhlelo zokusebenza -> Izinhlelo zokusebenza zebhizinisi -> Imvume nezimvume -> Izilungiselelo zemvume yomsebenzisi, shintsha ukusuka kokuthi Vumela imvume yomsebenzisi yezinhlelo zokusebenza kuye kokuthi Do not allow user consent (futhi unike amandla Ukugeleza Kokusebenza Kwemvume Yomphathi ukuze abasebenzi bachofoze okuthi "Cela Ukugunyazwa" esikhundleni sokunikeza ukufinyelela kwezinhlelo zokusebenza ezikhohlakele).
• Ku- Google Workspace Admin Console (admin.google.com) -> Ukuphepha -> Ukufinyelela nokulawulwa kwedatha -> Izilawuli ze-API -> Phatha Ukufinyelela Kuhlelo Lokusebenza Lwenkampani Yangaphandle, setha izikophu ezinobungozi obukhulu (Gmail, Drive) kuya Trusted: Can only access Google data if explicitly allowlisted by an admin.
• Dala Inqubomgomo Yokungena Kwe-ID Enemibandela Yokufinyelela uvimbele Device Code Flow indlela yokudlulisa ubuqiniso yabo bonke abasebenzisi abangebona unjiniyela.

Imibuzo evame ukubuzwa¶

Kungani ngingashintshanga iphasiwedi yami futhi ngivule i-Two-Factor Authentication (2FA) ngikhiphe uhlelo lokusebenza olunonya lwe-OAuth?¶

Amaphasiwedi kanye Nokuqinisekiswa Kwezinto Ezimbili kugada kuphela umnyango wangaphambili lapho umuntu engena ngesikrini sokungena. Uma uchofoza `Allow` ngemvume yokwaziswa kwe-OAuth 2.0, uyala i-Google, i-Microsoft, i-GitHub, noma i-Discord ukuthi ikhiphe i-cryptographic `Refresh Token` ngqo kuseva yohlelo lokusebenza lomuntu wesithathu ukuze uhlelo lokusebenza lusebenze ngemuva ngenkathi ungaxhunyiwe ku-inthanethi. Ngokuklama kwezakhiwo, izinkundla eziningi zivumela ukuhlanganiswa okugunyaziwe okuvela eceleni (njengamathuluzi okuvumelanisa ikhalenda, izinsizakalo eziyisipele, noma izixhumi ze-CRM) ukuthi ziqhubeke nokusebenza kuzo zonke izindlela zokuzungezisa amaphasiwedi ngaphandle kwalapho uya ngokusobala ekhasini lakho Lokuxhunywa Kuhlelo Lokusebenza Lwenkampani Yangaphandle bese uchofoza okuthi **Hoxisa / Susa Ukufinyelela**.

Isixhumanisi se-OAuth sobugebengu bokweba imininingwane ebucayi singaboniswa kanjani accounts.google.com noma login.microsoftonline.com nge-padlock ye-HTTPS yangempela uma bekuwumkhonyovu?¶

Ekuhlaselweni kobugebengu bokweba imininingwane ebucayi bemvume ye-OAuth, isigebengu asidali iwebhusayithi mbumbulu; esikhundleni salokho, babhalisa uhlelo lokusebenza lonjiniyela lwamahhala ngaphakathi kwe-Google Cloud noma i-Microsoft Azure (okuthatha imizuzu emi-2) futhi bakuthumelele isixhumanisi sangempela sokugunyazwa se-Google noma se-Microsoft esiqukethe izinhlelo zabo zokusebenza. `client_id`. Ngoba uvakashela iseva yokungena ye-Google noma ye-Microsoft yangempela, igama lesizinda nesitifiketi se-SSL ziyiqiniso ngamaphesenti angu-100. Inkohliso iku-**umnikazi wegama lohlelo lokusebenza lwenkampani yangaphandle** ecela imvume uma usungenile; ngokuchofoza `Allow` itshela i-Google yangempela noma iseva ye-Microsoft ukuthi inikeze idatha yakho kuhlelo lokusebenza lonjiniyela olubhalisiwe lwesigebengu.

Yini "Ubugebengu Bokweba imininingwane ebucayi" (microsoft.com/devicelogin), futhi kungani kuyingozi kangaka?¶

Isibonelelo Sigunyazo Sedivayisi se-OAuth 2.0 (`RFC 8628`) yadalwa ukuze ukwazi ukungena ngemvume kumadivayisi angenaso isiphequluli sewebhu noma ikhibhodi, njenge-Smart TV noma isixhumi esibonakalayo somugqa womyalo (CLI): i-TV ibonisa ikhodi enezinhlamvu ezingu-8 futhi ikutshela ukuthi uvule `microsoft.com/devicelogin` efonini yakho bese ufaka leyo khodi. Ekuhlaselweni kobugebengu bokweba imininingwane ebucayi yedivayisi, isigebengu sisebenzisa umbhalo (`TokenTactics` noma `RoadTools`) kukhompyutha yabo ukuze bakhiqize ikhodi entsha enezinhlamvu ezingu-8, bese bekuthumela ama-imeyili noma imilayezo ku-Teams/Slack ethi kufanele ufake leyo khodi kokuthi `microsoft.com/devicelogin` ukuze ubuke idokhumenti evikelekile noma uqinisekise i-akhawunti yakho. Okwesibili uthayipha amakhodi abo kusayithi langempela le-Microsoft, i-Microsoft ifaka ikhompuyutha yomgebengu we-inthanethi ngqo ku-akhawunti yakho ngezimangalo ezigcwele zokuqinisekiswa kwe-Multi-Factor esezinelisekile.

Ingabe "Ngena ngemvume nge-Google" okujwayelekile noma "Ngena ngemvume nge-Apple" kuyingozi uma i-popup icela kuphela Igama lami nekheli le-imeyili?¶

I-OpenID evamile Connect (`OIDC`) "Ngena ngemvume nge-Google / Apple / Microsoft" ikhuthaza ukuthi **kuphela** cela iphrofayela yakho eyisisekelo (`Name`, `Email address`, futhi `Profile picture`) empeleni ziphephe kakhulu kunokuthayipha igama-mfihlo kuwebhusayithi entsha, ngoba iwebhusayithi yezinkampani zangaphandle ayilokothi ilibone iphasiwedi yakho futhi ayikutholi ukufinyelela kwama-imeyili noma amafayela akho. Ingozi ivela kuphela lapho isigelekeqe semvume sikucela **izikophu ezengeziwe ezizwelayo ze-API**, njengokuthi *"Funda, bhala, thumela, futhi ususe unomphela yonke i-imeyili yakho,"* *"Bona, hlela, dala, futhi ususe wonke amafayela akho e-Google Drayivu,"* noma *"Joyina iziphakeli."* Funda njalo uhlu olunamachashazi lezimvume esikrinini semvume ngaphambi kokuchofoza.

Iziqondiso ezihlobene¶

• I-MFA phishing kanye ne-Adversary-in-the-Middle (AiTM) yokudlula
• Ukudunwa kwekhukhi lesikhathi, i-infostealer malware, nokuhoxiswa kokhiye wokudlula
• I-akhawunti ye-imeyili intshontshiwe: imithetho yokudlulisela phambili nokutholwa
• I-Compromise Ye-imeyili Yebhizinisi Lebhizinisi (BEC) kanye nokukhumbula ukukhwabanisa ngocingo
• Izandiso zesiphequluli ezinonya, izigebengu zebhodi lokunamathisela, nokususwa kwe-adware
• Izinombolo eziphuthumayo zomhlaba wonke

Imithombo ihloliwe¶

• I-Cybersecurity and Infrastructure Security Agency (CISA) & Federal Bureau of Investigation (FBI) (United States): I-Joint Cybersecurity Advisory on Illicit OAuth Consent Grants, Ubugebengu Bokweba imininingwane ebucayi (RFC 8628), kanye Nokwebiwa Kwethokheni Ye-Cloud Identity.
• I-Internet Engineering Task Force (IETF) (International): RFC 6749 (The OAuth 2.0 Authorization Framework), RFC 7009 (OAuth 2.0 Token Revocation), kanye ne-RFC 8628 (OAuth 2.0 Device Authorization Grant considerations).
• I-Microsoft Threat Intelligence & Microsoft Entra Security Engineering (International): I-Incident Response Playbook ye-Malicious OAuth Applications (OAuth2PermissionGrant) kanye Nobugebengu Bokweba imininingwane ebucayi ku-Microsoft Entra ID.
• I-Google Cloud ne-Google Workspace Security (International): I-OAuth 2.0 API Scope Verification, Ukuphathwa Kokufinyelela Kohlelo Lokusebenza Kwenkampani Yangaphandle, kanye Nesakhiwo Sokuhoxiswa Kwethokheni.
• Isikhungo Sikazwelonke Sokuvikeleka Kwe-Cyber ​​​​(NCSC) (e-United Kingdom): Isiqondiso Sokuvikela Abaqashi Bamafu Ngokumelene Nobugebengu Bokweba imininingwane ebucayi be-OAuth kanye Nokuhlukunyezwa Kwe-API Okuthunyelwe.