Episode 60: Cloud Persistence: Rogue MFA, OAuth and Passkeys

So let's back up a little bit.

Joe, take us through what we're seeing through for the clients, how that and how that is manifesting itself.

Yeah.

So and I'm going to include some of the security considerations and the defensive Asian that attackers are doing with this.

So the primary thing we're seeing is either through a vendor account or through just a random Gmail account, users are getting a shared document.

A document has been shared with you.

We've seen several variations of it, but one of the common ones is that they can change the – sender line to say anything.

So they'll choose a sender like a superintendent or the IT department or some trusted value in that field, but it's still coming from

Also, just to confirm here, because with the sender address, they're just manipulating the name.

Yes.

So the sender address is different from the from address, right? Or the sender value is different from the from address, right? So it's still coming from that Gmail account.

But all the user sees is this trusted name up at the top.

And it says, this person has shared this document with you.

Please.

And it's a Google Doc.

And it's a Google Doc.

So it's going through Google's infrastructure as far as where it's coming from.

And the reason that's important is the header address, which is the two.

If it was actually manipulating the domain, that would be solvable by DMARC.

Right.

So

it's getting around DMARC, DKIM, SPF because it's coming from Google's servers because it's going through Google's infrastructure.

And the sender is technically a Gmail account, and that's also okay.

So the messages are not only going to staff, but they're also going to students.

Yes.