Oasis Security has revealed the discovery of AuthQuake, a critical vulnerability in Microsoft’s Multi-Factor Authentication (MFA) implementation that would allow attackers to bypass MFA and gain unauthorized access to users’ Microsoft accounts.
With more than 400 million paid Office 365 seats, the potential impact of this vulnerability was far-reaching, putting sensitive resources such as Outlook emails, OneDrive files, Teams chats, and Azure Cloud at risk.
The latest Oasis Security report outlines the details of the vulnerability, its resolution, and provides actionable guidance for organizations using MFA. The researchers identified and demonstrated the bypass, which required no user interaction, generated no alerts, and could be executed in under 70 minutes with a 50% success rate.
Key details in the report include:
- The bypass exploited the lack of rate limiting and an extended timeframe for validating Time-Based One-Time Password (TOTP) codes.
- Oasis worked closely with Microsoft to resolve the issue, leading to the implementation of stricter rate limits.
- This discovery reinforces the importance of continuous vigilance in MFA implementation and security monitoring.
Microsoft fixed the flaw in October.
Here is what a few experts are saying about the discovery of AuthQuake:
Jason Soroko, Senior Fellow at Sectigo, a Scottsdale, Arizona-based provider of comprehensive certificate lifecycle management (CLM):
AuthQuake exposes significant flaws in Microsoft’s MFA implementation, revealing an important fact. Authentication systems based on shared secrets are inherently vulnerable. This discovery is a wake-up call. Organizations must act to adopt patches and reconsider their reliance on outdated MFA solutions. We must strive toward passwordless authentication solutions, especially for net new implementations.
++
Ms. Kris Bondi, CEO and Co-Founder of Mimoto, a San Francisco, Calif.-based end-to-end recognition company:
The latest report from Oasis Security on the discovery of AuthQuake highlights significant problems with MFA overall. When MFA is compromised, it quickly switches from a security tool to a significant attack vector. By gaining access to accounts of the 400 million paid users of Office 365, bad actors would be able to stealthily perform reconnaissance to find the most valuable systems and data. Additional hidden ways in, such as reverse shells, could be added for root access, which would bypass future authentication.
While MFA is better than the use of credentials alone, it should be considered an organization’s minimum acceptable practice, not a state of the art security measure. Even when MFA is operating as expected, it’s validating an endpoint at a specific point in time, not confirming it’s the correct person.
++
James Scobey, Chief Information Security Officer at Keeper Security:
The recent discovery of the AuthQuake vulnerability in Microsoft’s Multi-Factor Authentication (MFA) serves as a reminder that security isn’t just about deploying MFA – it must also be configured properly. While MFA is undoubtedly a powerful defense, its effectiveness depends on key settings, such as rate limiting to thwart brute-force attempts and user notifications for failed login attempts. These features are not optional; they are critical for enhancing visibility, allowing users to spot suspicious activity early and respond swiftly.
However, relying solely on MFA is insufficient when it comes to protecting an organization. Security must be layered and a comprehensive defense strategy, including Privileged Access Management (PAM), is essential. By enforcing the principle of least privilege, PAM ensures that even if an attacker successfully bypasses MFA, their access to sensitive resources is severely limited. This combination of MFA and PAM creates a robust barrier, making it much more difficult for attackers to escalate their access, even if they manage to breach one layer. In today’s sophisticated threat landscape, security should never be one-dimensional.
For systems and applications that cannot directly integrate with an identity provider using SAML for authentication, the secrets used to authenticate, such as API keys, need to be stored securely. Secrets managers and modern PAM systems provide an encrypted vault to store these secrets with granular access controls and audit logging. Storing secrets in a purpose-built secrets manager reduces the risk of exposure compared to hard-coding them in applications or config files and reduces the blast radius in the event of a compromise of the primary IdP.
Finally, this research underscores the importance of having robust detection and response capabilities for identity-based attacks. Enterprises should establish monitoring to alert on anomalous login patterns, such as a high volume of failed second factor attempts in a short time window for a single account. Proactively identifying and responding to these attacks can stop them before they lead to a breach.
In an era of increasingly sophisticated cyber threats, organizations must take a defense-in-depth approach to securing identities and access. Adopting strong MFA, securing secrets and monitoring for identity attacks are all critical components of a modern identity and access management strategy.
##
