IT Brew // Morning Brew // Update

CYBERSECURITY

Francis Scialabba

Maybe you’re trying to sign into Netflix on your Airbnb TV and you’re tired of typing your super-secure 25-character password with the remote. That’s when a device code—a six- to 12-digit password that you can type into a laptop or other device to gain access—comes in handy.

Recent industry reports have revealed a spike in device code phishing—not with your favorite movie app, but Microsoft environments like Office 365 and Entra ID. And the tactic is a tricky one to stop, because it takes advantage of a legitimate authentication flow.

The threat. Attackers trick targets into inputting the attacker’s device code, which links the attacker’s session to the victim’s account.

Step 1. An attacker spins up a legitimate email address. Next, they initiate a device authentication request, specifically to add a device to a target’s existing account. Why does this work? The flow banks on an already trusted device (and its tricked user) authenticating. “Multi-factor authentication is not an effective mitigation for this attack because the victim inputs the code, then their username and password, and then MFA code if applicable,” managed security platform company Huntress wrote in a March alert about the tactic.

Here’s what comes next.—BH

☕ Code red!