InfoSecBulletin Cybersecurity for mankind
Oasis Security discovered a flaw in Microsoft’s Multi-Factor Authentication (MFA) system, allowing attackers to bypass it and access user accounts, including Outlook, OneDrive, Teams, and Azure. With over 400 million Office 365 users, the impact of this vulnerability could be significant.
Research team claim, “The bypass was simple: it took around an hour to execute, required no user interaction and did not generate any notification or provide the account holder with any indication of trouble.”
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
Over 25K SonicWall VPN Firewalls exposed to critical flaws
AI-made nude images incident, one school, 50 female victim
Over 4 lac files ‘leaked’: Telecom Namibia hit by major cyberattack
HSBC sued by ASIC: customers allegedly scammed of $23 million
Sophos Thwarts Global Firewall Attack promptly, Protects Thousands from Data Theft
Android malware attack Indian banks: Infected 419 devices
Indian-American OpenAI whistleblower Suchir Balaji found dead in San Francisco
Canadian company exposed unprotected almost 5 million records
When users access the login page, they receive a session identifier. After entering a valid email and password, they must verify their identity. Microsoft offers various MFA methods, such as using a verification code from an app. Users enter a 6-digit code from the app to complete the authentication. Up to 10 consequent failed attempts were allowed for a single session.
The Oasis research team quickly generated new sessions and codes, demonstrating that they could rapidly exhaust all options for a 6-digit code (1 million combinations). In simple terms, they could make many attempts at once.
Oasis informed Microsoft of the issue, which acknowledged its existence in June and fixed it permanently by Oct. 9, the researchers said. “While specific details of the changes are confidential, we can confirm that Microsoft introduced a much stricter rate limit that kicks in after a number of failed attempts; the strict limit lasts around half a day,” Hason wrote.
Vulnerability timeline and Microsoft response:
24/06/2024 – Microsoft Acknowledgment of the issue
04/07/2024 – Microsoft Deployed a temporary fix
09/10/2024 – Microsoft Deployed Permanent Fix
Click here to read the full story.
Source: oasis.security
