How did a hacker bypass our multi-factor?

Hello Joe Aas,

Good day. Thanks for posting in the community.

I am sorry to hear that the hacker bypassed the multi-factor. There are three dominant forms of MFA bypass attacks commonly seen today: MFA fatigue, token theft, and Machine-in-the-Middle attacks.

MFA fatigue is one of the most common and high-profile ways to bypass MFA. It is seen as a form of social engineering, as it involves cybercriminals manipulating users into giving them access to their accounts unwittingly. The way MFA fatigue works is straightforward. MFA often requires end-users to make an action on a personal device to gain access to an account. For example, a pop-up may appear on a smartphone, or an email may be sent, which, when accepted, will then allow a user access. However, if a cybercriminal is able to compromise a username and password, this means they can request access to the legitimate user over and over again, sending pop-up after pop-up, until the user gives in and accepts.

Token theft is one of the most common forms of MFA bypass attacks. The way multi-factor authentication protocols work is that, once you’ve been introduced to an application, it may place a session cookie on your machine that allows you to continue. If an attacker picks up that session cookie and moves it to another machine, all of the rules that were in place to get that cookie are irrelevant, and you have a problem.  There are various types of cookies that can be stolen. So, attackers are looking at cookie theft as a way to bypass good security. So, endpoint protection actually becomes more important, because you’ve got to keep that malware off of your machine. Essentially, this attack involves cybercriminals scraping cookies, the session code used by web browsers to track users as they log-in to different web pages. Cookies are designed to reduce friction for users, meaning they don’t have to re-authenticate every time they access a different webpage in the same session. When these attacks are successful, this allows criminals to place these cookies into their own session, and thereby trick the browser into believing they are the authenticating user and bypassing MFA.

The third form of MFA bypass is Machine-in-the-Middle, or Adversary-in-the-Middle attacks. This is a form of phishing attack which is used to trick users into clicking a malicious link, giving cybercriminals access to machines while circumventing MFA controls. 

Firstly, an attacker will trick a user into clicking on a malicious URL, directing the user to a malicious proxy server. Using this server, the attacker will then be able to intercept network traffic between the user’s computer and the real web server. This will then allow the attack to capture data from the user’s web session, including credentials, and MFA session cookies, allowing the execution of a token theft attack. 

There are some ways for organizations to mitigate these attacks. First piece of advice is to ensure that your organization has MFA switched on.

• The first important step to avoiding MFA fatigue attacks it to set limits on the number of MFA push notifications that can be made before access is accepted into accounts, or to disallow the use of push notifications altogether as an authentication method. This is an important feature to look for in an enterprise MFA solution. 

• Number matching is a security feature designed to prevent MFA bypass by ensuring that only a legitimate user requesting access is able to authenticate their identity. The way it works is straightforward: when a user needs to approve a sign-in attempt, they’ll be given a code on their browser, which they must then input onto their mobile device to allow the authentication. 

• The ways in which attackers both gain access to passwords and execute MFA fatigue attacks rely on a common denominator: human error. Users don’t often consider security, authenticator apps, or session tokens. They simply want to log on and get their work for the day done. Cybercriminals exploit this lack of awareness to trick users with attacks designed to trick users into giving up their credentials. 

• Security awareness training can be an important way to help demonstrate to users the importance of good security hygiene. In the case of MFA fatigue attacks, awareness training be hugely significant: a user who knows about the risks of compromised accounts and phishing is unlikely to be fooled by spammed push notifications. 

If you find my information useful, please help me vote on it. With your vote, other users who are looking for the same details on this community site can easily find this thread.

Thanks for choosing the MS community.

Looking forward to your response and have a great day ahead!!

Sincerely

Md Ashabul Haque | Microsoft Community Moderator