6 ms·

>"able to trick the Microsoft platform’s authentication" So they social engineered the password, and if MFA was on it was push based MFA and the user just clic

by syshum 6y ago

>"able to trick the Microsoft platform’s authentication" So they social engineered the password, and if MFA was on it was push based MFA and the user just clicked OK to all popups on their phone?

Spooky23 6y ago
Depends on how they do things. Clicking “yes” on a phone wouldn’t be happening at higher trust levels. If they offload auth to a on-prem or third party IdP (common in big hybrid O365 tenants), there are often different paths, implementation screwups or bugs that let you bypass MFA. Microsoft’s position is “buy Azure AD, Buy M365, Buy ATP” and other paths are poorly tested, or they explicitly tell you to F off. Also remember that federal agencies are bigger than most fortune 50 companies, are usually global in scope and have lots of collaborations with other agencies and other third parties, and may have independent pockets within the agency. Those friction points are where problems tend to happen!
jiggawatts 6y ago
This is my experience with Microsoft: they view all security features as binary. As in: Encryption: Yes. Multi-factor authentication: Yes. Do they care if the MFA is simply the user pecking at buttons like a bird trained with seeds: No. There is a real problem with Azure AD MFA. Unlike the consumer MFA, it shows you exactly zero information about the source of the information. None. You get a choice of "approve" or "do not approve". You don't get any input information for making this decision. Hacking this is trivial. If you know someone's password, you just have to occasionally try logging in. Eventually the user will accidentally click approve even though they didn't trigger the authentication. You'd assume that nobody would ever fall for something like this, because surely nobody would be so stupid as to approve an MFA prompt they didn't trigger. Meanwhile, my Microsoft Authenticator app triggers randomly about 5-10 times per day because every single MS app insists on "reauthenticating" me every 24 hours. So I'll be sitting at my desk and my phone will pop it up randomly. I'll look up, and sure enough, Teams wants me to re-MFA for some stupid reason. I'm paranoid enough that I'll always reject these MFA prompts and then start the login cycle manually, but most people would just peck the button like a trained bird. Similarly, I've run scripts before that needed 6 MFA prompts to complete (don't ask). I ran the script once and it asked 7 times... uh-oh. Is this an Azure bug, or a hacker from China? How could I possibly know?! The information is not provided to me! This is Microsoft's fault, 110%, and I dare anyone here to argue otherwise. So instead of reaching for the downvote button, make your case on how "yes, yes, yes, yes" is not a security disaster below in the comments please.
- Spooky23 6y ago
  That isn’t Microsoft’s fault. They are providing a tool and your admins did not set it up in the most secure or sensible way. Your actions may make it some If these things happen as well. I can think of a few organizations where your script would have resulted in your account being locked down and a security incident.
  - bambataa 6y ago
    How is it not Microsoft's fault if they don't provide the user with any information to decide whether the MFA request is legit?
    - baobabKoodaa 6y ago
      There's literally no upside to hiding this information.
      - jlgaddis 6y ago
        To be honest, though, if they did provide all the details, they'd criticized for "overwhelming" users with too much information -- most of which would probably be useless to the majority of users who either wouldn't (care|pay attention|understand) anyways. That said, I'm sure there's a reasonable level somewhere in the middle. The current situation certainly doesn't sound like it, although I haven't used any form of Microsoft MFA, so I can't really say either way.
  - olefoo 6y ago
    Imagine if an automobile manufacturer allowed you to configure the safety features of your car and had the defaults set to unsafe but convenient values to help sell vehicles... do you think the manufacturers should evade liability?
    - tw04 6y ago
      They absolutely do. In northern climates where there is snow and ice on the roads for 3+ months out of the year, a car MFG will GLADLY sell you a vehicle with sport/summer tires. If you try driving with those in the winter: at best you'll get stuck, at worst you'll slide through the first intersection you come to and die in a fiery crash. Just about every business will have options that are a perfectly reasonable choice in some circumstances and really, really stupid in others.
katbyte 6y ago
Your assuming they had mfa enabled!

by syshum 6y ago

>"able to trick the Microsoft platform’s authentication" So they social engineered the password, and if MFA was on it was push based MFA and the user just clicked OK to all popups on their phone?

Spooky23 6y ago

Depends on how they do things. Clicking “yes” on a phone wouldn’t be happening at higher trust levels. If they offload auth to a on-prem or third party IdP (common in big hybrid O365 tenants), there are often different paths, implementation screwups or bugs that let you bypass MFA. Microsoft’s position is “buy Azure AD, Buy M365, Buy ATP” and other paths are poorly tested, or they explicitly tell you to F off. Also remember that federal agencies are bigger than most fortune 50 companies, are usually global in scope and have lots of collaborations with other agencies and other third parties, and may have independent pockets within the agency. Those friction points are where problems tend to happen!

jiggawatts 6y ago

This is my experience with Microsoft: they view all security features as binary. As in: Encryption: Yes. Multi-factor authentication: Yes. Do they care if the MFA is simply the user pecking at buttons like a bird trained with seeds: No. There is a real problem with Azure AD MFA. Unlike the consumer MFA, it shows you exactly zero information about the source of the information. None. You get a choice of "approve" or "do not approve". You don't get any input information for making this decision. Hacking this is trivial. If you know someone's password, you just have to occasionally try logging in. Eventually the user will accidentally click approve even though they didn't trigger the authentication. You'd assume that nobody would ever fall for something like this, because surely nobody would be so stupid as to approve an MFA prompt they didn't trigger. Meanwhile, my Microsoft Authenticator app triggers randomly about 5-10 times per day because every single MS app insists on "reauthenticating" me every 24 hours. So I'll be sitting at my desk and my phone will pop it up randomly. I'll look up, and sure enough, Teams wants me to re-MFA for some stupid reason. I'm paranoid enough that I'll always reject these MFA prompts and then start the login cycle manually, but most people would just peck the button like a trained bird. Similarly, I've run scripts before that needed 6 MFA prompts to complete (don't ask). I ran the script once and it asked 7 times... uh-oh. Is this an Azure bug, or a hacker from China? How could I possibly know?! The information is not provided to me! This is Microsoft's fault, 110%, and I dare anyone here to argue otherwise. So instead of reaching for the downvote button, make your case on how "yes, yes, yes, yes" is not a security disaster below in the comments please.

Spooky23 6y ago
That isn’t Microsoft’s fault. They are providing a tool and your admins did not set it up in the most secure or sensible way. Your actions may make it some If these things happen as well. I can think of a few organizations where your script would have resulted in your account being locked down and a security incident.
- bambataa 6y ago
  How is it not Microsoft's fault if they don't provide the user with any information to decide whether the MFA request is legit?
  - baobabKoodaa 6y ago
    There's literally no upside to hiding this information.
    - jlgaddis 6y ago
      To be honest, though, if they did provide all the details, they'd criticized for "overwhelming" users with too much information -- most of which would probably be useless to the majority of users who either wouldn't (care|pay attention|understand) anyways. That said, I'm sure there's a reasonable level somewhere in the middle. The current situation certainly doesn't sound like it, although I haven't used any form of Microsoft MFA, so I can't really say either way.
- olefoo 6y ago
  Imagine if an automobile manufacturer allowed you to configure the safety features of your car and had the defaults set to unsafe but convenient values to help sell vehicles... do you think the manufacturers should evade liability?
  - tw04 6y ago
    They absolutely do. In northern climates where there is snow and ice on the roads for 3+ months out of the year, a car MFG will GLADLY sell you a vehicle with sport/summer tires. If you try driving with those in the winter: at best you'll get stuck, at worst you'll slide through the first intersection you come to and die in a fiery crash. Just about every business will have options that are a perfectly reasonable choice in some circumstances and really, really stupid in others.

katbyte 6y ago

Your assuming they had mfa enabled!