Consider the following hypothetical scenario:
- I create the PhotoApp - native Android application that is used by users to manage their private photos.
- I create the PhotoService - Web API that is accessed by the native PhotoApp, providing the access and storage of the photos.
- Both applications are registered in the Azure AD and the PhotoApp is given the permission to access the PhotoService.
- PhotoApp uses Azure AD middleware web flow to provide a login to the application and access to the PhotoService.
- PhotoApp is launched and available to users.
- Malicious party downloads PhotoApp and extracts the TenantID, ClientID and rest of the authentication stuff from the app package.
- Malicious party creates rogue application BanditApp which uses same authentication configuration (TenantID, ClientID, ...) as the original PhotoApp.
- BanditApp is launched and available to users.
- The Azure AD is unable to distinguish between original PhotoApp and BanditApp.
- User logs into the BanditApp.
- The BanditApp steals photos from the user.
- The Azure AD and PhotoService are now involved in illegal activities.
Is this viable scenario?
How to protect this from happening?