🔶 Why AWS SSO is vulnerable by design to device code authentication phishing?

"In this post, we demonstrate that AWS SSO is vulnerable by design to device code authentication phishing – just like any identity provider implementing OpenID Connect device code authentication. This technique was first demonstrated by Dr. Nestori Syynimaa for Azure AD. The feature provides a powerful phishing vector for attackers, rendering ineffective controls such as MFA (including Yubikeys) or IP allow-listing at the IdP level."

https://blog.christophetd.fr/phishing-for-aws-credentials-via-aws-sso-device-code-authentication/

#aws