InfoSecBulletin Cybersecurity for mankind
Oasis Security discovered a flaw in Microsoft’s Multi-Factor Authentication (MFA) system, allowing attackers to bypass it and access user accounts, including Outlook, OneDrive, Teams, and Azure. With over 400 million Office 365 users, the impact of this vulnerability could be significant.
Research team claim, “The bypass was simple: it took around an hour to execute, required no user interaction and did not generate any notification or provide the account holder with any indication of trouble.”
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
When users access the login page, they receive a session identifier. After entering a valid email and password, they must verify their identity. Microsoft offers various MFA methods, such as using a verification code from an app. Users enter a 6-digit code from the app to complete the authentication. Up to 10 consequent failed attempts were allowed for a single session.
The Oasis research team quickly generated new sessions and codes, demonstrating that they could rapidly exhaust all options for a 6-digit code (1 million combinations). In simple terms, they could make many attempts at once.
Oasis informed Microsoft of the issue, which acknowledged its existence in June and fixed it permanently by Oct. 9, the researchers said. “While specific details of the changes are confidential, we can confirm that Microsoft introduced a much stricter rate limit that kicks in after a number of failed attempts; the strict limit lasts around half a day,” Hason wrote.
Vulnerability timeline and Microsoft response:
24/06/2024 – Microsoft Acknowledgment of the issue
04/07/2024 – Microsoft Deployed a temporary fix
09/10/2024 – Microsoft Deployed Permanent Fix
Click here to read the full story.
Source: oasis.security
