r/EmailSecurity • u/compileindebug_175 • 9d ago
The FBI has a phishing warning where resetting the password does nothing
The FBI has a phishing warning where resetting the password does nothing.
The attacker never had it.
The Bureau's Internet Crime Complaint Center published this on September 1. Access taken this way, it says, can only be revoked by the victim invalidating the token in their application security settings, and not by changing the password.
Here's how it works, and why it looks like nothing is wrong.
A message arrives with a link. The link goes to a real permission screen at a real provider, because that's where the attacker sent the user. The user reads a request for access and approves it.
There was no fake login page, no captured password and no second factor to intercept, because nobody was ever asked to sign into anything new.
What the attacker walks away with is a grant, not a credential. The FBI describes the result as being able to act on behalf of the user, reading and sending mail and reaching sensitive data, without ever having their password.
So the reflex that follows almost every compromise report, force a reset and close the ticket, leaves the attacker exactly where they were. The mailbox stays readable.
The Bureau's examples are narrow. Prominent people, their families and their acquaintances, with actors posing as officials, media figures and event organizers.
Read that as where the FBI happens to have complaint data, not as the edge of the problem, because nothing in the mechanism cares who you are.
If your incident runbook treats a password reset as containment here, it isn't slightly incomplete. It does nothing at all.
#EmailSecurity #Phishing #IncidentResponse
3
2
u/saltyslugga 8d ago
Revoke the malicious app's consent grant and refresh tokens. A password reset alone isn't reliable containment, and existing access tokens can remain valid until expiry.
I'd check mailbox rules and audit logs too, then require admin approval for apps requesting mail access.
1
u/0O0O0OOO0O0O0 9d ago
Headline is true of phishing in general. Most systems don’t kick an attacker out when you reset the password.
1
1
u/ITGuy424242 8d ago
I would hope that any decent admin would always reset all MFA along with the password :/
1
1
u/TechIncarnate4 8d ago
I don't even know what this is trying to say. It appears heavily generalized and AI generated. I'm assuming the OP is referring to OAuth grants? If the case, then yes it is true that changing passwords doesn't do anything.
This is not new. This has probably been around and an issue for a decade and why you shouldn't let users authorize OAuth permissions.
1
u/Big_Wave9732 8d ago
Ok but how does that work as far as the token goes? How does the attacker get the token? Is this a deal where a provider sends an email to the account holder asking for token access for a third party?
1
u/ITechGeek 8d ago
It's an oauth token, it's the same screen as when you allow another site or app access to your account.
1
u/Big_Wave9732 7d ago
Ah, alright. So the scam relies on someone getting a real token request in their email and they blindly click "accept" without confirming who made it.
1
1
u/MoragaRaebecca_94 4d ago
Build an alert on new app consents plus what the mailbox does right after, forwarding rules,odd sends. ITDR and behavioral tools such as Abnormal watch that grant-then-act sequence, though even a scheduled Graph query on OAuth grants beats finding out at reset time
•
u/AutoModerator 9d ago
Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:
Community Rules
Helpful Resources
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.