Google OAuth: Abandoned Domains Attack

The “Google OAuth: Abandoned Domains Attack” is a security concern where attackers exploit abandoned or expired domains to manipulate Google OAuth authentication flows. This can lead to unauthorized access, phishing, or token theft. Kaspersky’s research highlights how attackers register expired domains previously trusted by Google OAuth to bypass security checks.

Read more: Kaspersky

You Should Know:

1. Identifying Abandoned Domains

Use Linux commands to check domain expiration:

whois example.com | grep "Expiry Date" 

Or with `curl` and DNS checks:

curl -I https://example.com 
dig example.com 

#### **2. Mitigating OAuth Risks**

• Revoke unused OAuth credentials:

  </li>
  </ul>
  
  <h1>Use Google's OAuth API to list and revoke tokens</h1>
  
  curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" https://www.googleapis.com/oauth2/v1/tokeninfo 
  

  – Monitor domain registrations:

  
  <h1>Use crontab to automate domain checks</h1>
  
  0 * * * * whois yourdomain.com | grep "Expiry Date" >> /var/log/domain_check.log 
  

  #### **3. Secure OAuth Configurations**

  • Restrict redirect URIs in Google Cloud Console.
  • Enable 2FA for all admin accounts:

    </li>
    </ul>
    
    <h1>Linux 2FA setup (Google Authenticator)</h1>
    
    sudo apt install libpam-google-authenticator 
    google-authenticator 
    

    #### **4. Windows Auditing**

    Check OAuth-linked apps via PowerShell:

    Get-AzureADServicePrincipal | Where-Object { $_.PublisherName -eq "Google" } | Format-List 
    

    #### **5. Token Inspection**

    Decode JWT tokens (if compromised) using:

    echo "YOUR_JWT_TOKEN" | jq -R 'split(".") | .[1] | @base64d | fromjson' 
    

    ### **What Undercode Say:**

    Abandoned domains pose a silent threat to OAuth ecosystems. Regularly audit domain registrations, automate expiration checks, and enforce strict redirect URI policies. Use Linux tools like whois, dig, and `jq` for proactive defense. On Windows, leverage PowerShell to monitor Azure AD integrations. Always revoke stale tokens and enforce MFA.

    ### **Expected Output:**

    • Domain expiry alerts.
    • Revoked suspicious OAuth tokens.
    • Secure JWT validation logs.
    • MFA-enabled admin access.

    References:

    Reported By: Florian Hansemann – Hackers Feeds
    Extra Hub: Undercode MoN
    Basic Verification: Pass ✅

    Join Our Cyber World:

    💬 Whatsapp | 💬 Telegram