4 ms·

Oasis Security Research Team Discovers Microsoft Azure MFA Bypass

33 points by doener 2y ago

s09dfhks 2y ago
So they brute forced 2fac codes?
- hx833001 2y ago
  Yes, because of a horrendous implementation by Microsoft. 3 minutes instead of 30 second TOTP validity and unlimited guesses.
  - fckgw 2y ago
    Technically, 10 guesses per session but unlimited sessions.
- m_xor_t 2y ago
  I think so. But I would argue that it is a valid issue that they were able to do it. There are solutions to bruteforce attacks, such as rate limiting, exponential backoffs, alerting et cetera. I wonder why they are not in place for Azure MFA.
ziddoap 2y ago
Please stop saying "change your password regularly". Despite being a theoretical security increase, it has been shown repeatedly that it is a practical security decrease as it encourages both simpler passwords and incremental passwords. It also makes your users hate you, which isn't great. A security company should know this. It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now. I start to really question the expertise of any security company that parrots this outdated advice. What else are they not keeping up on? Focus on monitoring, alerting, educating, etc. Force password changes only when there are indicators of compromise.
- beardedwizard 2y ago
  I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). When I think big picture mfa exists because passwords are often assumed lost to infostealers, so changing your password seems moot for an adversary who is ready to brute force your mfa.
  - ezekg 2y ago
    > I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). Why would you avoid TOTP altogether? Yes, SMS OTP is insecure because SMS is insecure, but OTP itself is fine, unless I missed something?
    - computerfriend 2y ago
      TOTP is phishable.
  - halfcat 2y ago
    Passkeys address the phishing angle, but as always it’s a trade off. With passkeys if someone gets remote control of your computer they have access to everything you setup a passkey for. Typically people say “well full remote control is far less common than phishing”, and it is, for now, until everyone’s using passkeys and all of the sophisticated phishing attack effort just shifts to passkeys. The obvious weak point here is all of the outsourced IT who aren’t specifically focused on cybersecurity. Every IT company is using multiple tools for central management that either allows remote control or remote execution, or there’s always in-house developers who realistically aren’t doing a security analysis of every third-party library they’re installing.
    - beardedwizard 2y ago
      You can still require biometric to unlock passkey for each use, so the risk is really about authenticated session theft in that scenario
beardedwizard 2y ago
I thought I would make it through the day without seeing "non human identity" in a security company pitch, I was wrong. Not much to say about this article except that it's one more in a long trend of security startups hyping bugs to attract business. I'm not loving how they claim it's MFA bypass when it's really brute force, though I wouldn't necessarily minimize the attack overall either, I'm more curious how widespread these kinds of timeout bugs might be in other places.
- deleted 2y ago
  [deleted]
seanieb 2y ago
TLDR; Microsoft didn’t have rate-limiting on their TOTP MFA if you opened different tabs. Allowing attackers enough guesses to get the users MFA code.
emptiestplace 2y ago
[flagged]
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
nonrandomstring 2y ago
If security is important to you (and I think it should be) the problem with outsourcing your technology to a company like Microsoft, Google, Amazon or whatever is that you've no means of really testing it. This could have gone unnoticed for years as so many cloud provider gaffes do. It's unlikely that anyone would think "Hey let's try brute forcing the login today". This violates trust-but-verify. You accept their say-so and so you're fully delegating trust. And because you're paying thousands of bucks for a service you assume it must be good. That's the very model of a (con)fidence trick. You don't even know you bought a lemon until its too late. There's no substitute for having someone qualified and educated in cybersecurity with that as their full-time job - and better yet bring your critical assets back on-prem with some kind of hybrid setup. Big cloud is really eating at the McDonalds of cybsersecurity.
- SvenL 2y ago
  Doesn’t this just shift the problem? From trusting a company it knows about security to trusting ONE person she/he knows about security? I would rather trust a company with x persons working on security than one person. Yes Big Company Microsoft got this one wrong (and also some other), but how many did they right? It’s always easy to be mad at failure if we overlook the times where something was done right.
  - nonrandomstring 2y ago
    > Doesn't this just shift the problem? No. Perhaps counter-intuitively the "problem" isn't trust here. What I'm raising above is not the necessity to trust but the extent to which verification is possible or frustrated. For example, with open versus proprietary code you may or may not have the capacity to audit it, but you always have the possibility. > I would rather trust a company with x persons Trustworthiness does not scale in this way. Though the "many eyes" theory has some weight, we also say "two people can keep a secret if one of them is dead." Assigning more cooks to the broth yields rapidly diminishing returns for reasons Fred Brooks explains [0]. But that is not my strongest objection. A more serious reason not to trust a BigTech company with your security is the "principal agent problem" [1]. As Ross Anderson puts it; "If Alice guards a system and Bob pays the cost of failure, you can expect trouble!" [2]. Microsoft does not "pay the price". Worse, Google (and Meta, Linked-In etc) base their business model on your insecurity - they are primarily in the business of acquiring data about you to use in selling your person to advertisers. They are therefore motivated, however weakly, against your actual security. It's a scandal that such companies also act as data processors and suppliers of services like online storage. So while you can outsource trust, you cannot unload responsibility to verify. A solution is education based on a credo of "principles not products" [4]. [0] https://en.wikipedia.org/wiki/The_Mythical_Man-Month https://en.wikipedia.org/wiki/The_Mythical_Man-Month [1] https://en.wikipedia.org/wiki/Principal-agent_problem https://en.wikipedia.org/wiki/Principal-agent_problem [2] https://www.csail.mit.edu/news/dertouzos-distinguished-lecture-prof-ross-anderson https://www.csail.mit.edu/news/dertouzos-distinguished-lectu... [3] https://techrights.org/n/2024/09/25/Technology_rights_or_responsibilities.shtml https://techrights.org/n/2024/09/25/Technology_rights_or_res... [4] https://cybershow.uk/blog/posts/principles https://cybershow.uk/blog/posts/principles
sebazzz 2y ago
At our place we work with secondary accounts that have their password expire every 8 hours - instead of primary accounts with MFA (though sometimes MFA is also enforced for the secondary account, but interestingly not for Azure Portal). Of course, the vault where those accounts are stored is a complete enterprise product with associated usability so what ends up happening is that people copy their passwords to an Excel sheet, or worse to Windows sticky notes, which often get up getting screen-shared in Teams calls.

33 points by doener 2y ago

s09dfhks 2y ago

So they brute forced 2fac codes?

hx833001 2y ago
Yes, because of a horrendous implementation by Microsoft. 3 minutes instead of 30 second TOTP validity and unlimited guesses.
- fckgw 2y ago
  Technically, 10 guesses per session but unlimited sessions.
m_xor_t 2y ago
I think so. But I would argue that it is a valid issue that they were able to do it. There are solutions to bruteforce attacks, such as rate limiting, exponential backoffs, alerting et cetera. I wonder why they are not in place for Azure MFA.

ziddoap 2y ago

Please stop saying "change your password regularly". Despite being a theoretical security increase, it has been shown repeatedly that it is a practical security decrease as it encourages both simpler passwords and incremental passwords. It also makes your users hate you, which isn't great. A security company should know this. It's been strictly recommended against in the NIST guidelines (and others) for nearing a decade now. I start to really question the expertise of any security company that parrots this outdated advice. What else are they not keeping up on? Focus on monitoring, alerting, educating, etc. Force password changes only when there are indicators of compromise.

beardedwizard 2y ago
I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). When I think big picture mfa exists because passwords are often assumed lost to infostealers, so changing your password seems moot for an adversary who is ready to brute force your mfa.
- ezekg 2y ago
  > I would have thought the advice here would be use passkeys everywhere you can and avoid Totp altogether (particularly the sms variant which has real risks today). Why would you avoid TOTP altogether? Yes, SMS OTP is insecure because SMS is insecure, but OTP itself is fine, unless I missed something?
  - computerfriend 2y ago
    TOTP is phishable.
- halfcat 2y ago
  Passkeys address the phishing angle, but as always it’s a trade off. With passkeys if someone gets remote control of your computer they have access to everything you setup a passkey for. Typically people say “well full remote control is far less common than phishing”, and it is, for now, until everyone’s using passkeys and all of the sophisticated phishing attack effort just shifts to passkeys. The obvious weak point here is all of the outsourced IT who aren’t specifically focused on cybersecurity. Every IT company is using multiple tools for central management that either allows remote control or remote execution, or there’s always in-house developers who realistically aren’t doing a security analysis of every third-party library they’re installing.
  - beardedwizard 2y ago
    You can still require biometric to unlock passkey for each use, so the risk is really about authenticated session theft in that scenario

beardedwizard 2y ago

I thought I would make it through the day without seeing "non human identity" in a security company pitch, I was wrong. Not much to say about this article except that it's one more in a long trend of security startups hyping bugs to attract business. I'm not loving how they claim it's MFA bypass when it's really brute force, though I wouldn't necessarily minimize the attack overall either, I'm more curious how widespread these kinds of timeout bugs might be in other places.

deleted 2y ago
[deleted]

seanieb 2y ago

TLDR; Microsoft didn’t have rate-limiting on their TOTP MFA if you opened different tabs. Allowing attackers enough guesses to get the users MFA code.

emptiestplace 2y ago

[flagged]

deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

nonrandomstring 2y ago

If security is important to you (and I think it should be) the problem with outsourcing your technology to a company like Microsoft, Google, Amazon or whatever is that you've no means of really testing it. This could have gone unnoticed for years as so many cloud provider gaffes do. It's unlikely that anyone would think "Hey let's try brute forcing the login today". This violates trust-but-verify. You accept their say-so and so you're fully delegating trust. And because you're paying thousands of bucks for a service you assume it must be good. That's the very model of a (con)fidence trick. You don't even know you bought a lemon until its too late. There's no substitute for having someone qualified and educated in cybersecurity with that as their full-time job - and better yet bring your critical assets back on-prem with some kind of hybrid setup. Big cloud is really eating at the McDonalds of cybsersecurity.

SvenL 2y ago
Doesn’t this just shift the problem? From trusting a company it knows about security to trusting ONE person she/he knows about security? I would rather trust a company with x persons working on security than one person. Yes Big Company Microsoft got this one wrong (and also some other), but how many did they right? It’s always easy to be mad at failure if we overlook the times where something was done right.
- nonrandomstring 2y ago
  > Doesn't this just shift the problem? No. Perhaps counter-intuitively the "problem" isn't trust here. What I'm raising above is not the necessity to trust but the extent to which verification is possible or frustrated. For example, with open versus proprietary code you may or may not have the capacity to audit it, but you always have the possibility. > I would rather trust a company with x persons Trustworthiness does not scale in this way. Though the "many eyes" theory has some weight, we also say "two people can keep a secret if one of them is dead." Assigning more cooks to the broth yields rapidly diminishing returns for reasons Fred Brooks explains [0]. But that is not my strongest objection. A more serious reason not to trust a BigTech company with your security is the "principal agent problem" [1]. As Ross Anderson puts it; "If Alice guards a system and Bob pays the cost of failure, you can expect trouble!" [2]. Microsoft does not "pay the price". Worse, Google (and Meta, Linked-In etc) base their business model on your insecurity - they are primarily in the business of acquiring data about you to use in selling your person to advertisers. They are therefore motivated, however weakly, against your actual security. It's a scandal that such companies also act as data processors and suppliers of services like online storage. So while you can outsource trust, you cannot unload responsibility to verify. A solution is education based on a credo of "principles not products" [4]. [0] https://en.wikipedia.org/wiki/The_Mythical_Man-Month https://en.wikipedia.org/wiki/The_Mythical_Man-Month [1] https://en.wikipedia.org/wiki/Principal-agent_problem https://en.wikipedia.org/wiki/Principal-agent_problem [2] https://www.csail.mit.edu/news/dertouzos-distinguished-lecture-prof-ross-anderson https://www.csail.mit.edu/news/dertouzos-distinguished-lectu... [3] https://techrights.org/n/2024/09/25/Technology_rights_or_responsibilities.shtml https://techrights.org/n/2024/09/25/Technology_rights_or_res... [4] https://cybershow.uk/blog/posts/principles https://cybershow.uk/blog/posts/principles

sebazzz 2y ago

At our place we work with secondary accounts that have their password expire every 8 hours - instead of primary accounts with MFA (though sometimes MFA is also enforced for the secondary account, but interestingly not for Azure Portal). Of course, the vault where those accounts are stored is a complete enterprise product with associated usability so what ends up happening is that people copy their passwords to an Excel sheet, or worse to Windows sticky notes, which often get up getting screen-shared in Teams calls.