A number of stories this past week have been discussing the dangers of Device Code Flow, a now-disfavored authentication mechanism in OAuth 2.0. Kasperky’s writeup is the best explainer I’ve seen of the attack.
Talos also had a writeup of the “ARToken” campaign that uses this technique.
Device Code Flow was intended for input-constrained devices like Smart TVs. Think like signing into your Hulu account using a short code. It’s not really appropriate for normal auth.
Actions
Entra admins: If you don’t need device code authorization, disable it.
You can and should monitor for DeviceCodeSignIn authorization events in Entra.
One ‘normal’/‘common’ case where you might see device code flow is some of MS’ newer Teams Room related stuff. Some time back they increased the amount of use in those cases to try to make authenticating input-limited devices suck less. They provide some basic CA policy guidance to cover that case.
I’ve also seen it with certain embedded devices(android-powered barcode readers and printers used by logistics staff; I suspect that there are other variations) that interact with Dynamics 365 ERP. Same basic rules apply in terms of scoping that down as tightly as you can in CA.
Basically no reason a ‘normal’ account/user access scenario should be touching device code flow; it might as well have been designed as a phishing mechanism for how suitable to that purpose it is.
