The majority of data breaches continue to stem from stolen credentials. And while multi-factor authentication (MFA) remains one of the most essential and effective controls against account takeover using stolen credentials, it’s far from universally adopted.However, there’s plenty of evidence today to suggest that users are coming to accept and expect MFA as part of their everyday sign-in experience.With this in mind, CISOs must consider how attackers are likely to respond when MFA coverage becomes substantially higher compared to today. Increasingly, organizations are targeted not on the basis of whether accounts are protected by MFA, but by how easily attackers can bypass the MFA.In today’s threat environment, security leaders should assess which of their authentication flows need to be phishing-resistant.
Adversaries can also bypass MFA if they previously compromised a trusted channel for authentication or password reset tokens, such as during SIM swapping attacks or when tokens are sent to a compromised email account. When this happens, the secret used to verify a login event is sent to a device or user account controlled by the attacker.The next most common form of MFA bypass stems from phishing and other forms of social engineering.Most commodity phishing kits are designed to capture the target’s username and password, as well as the one time password (OTP) used to verify the user during an MFA challenge. Phishing kits often pipe these stolen credentials directly to a Telegram channel or some other online forum so as to use them prior to the OTP expiring. When OTPs do expire, we often observe attackers engaging in second-stage social engineering attacks – sometimes calling their target on the phone or engaging in MFA fatigue attacks.However, the phishing attacks that most often lead to an account takeover event work quite differently. They use real-time, adversary-in-the-middle (AiTM) phishing proxies. As with a static phishing campaign, the target gets tricked into entering their credentials into an attacker-controlled phishing site. But when that phishing site also acts as a proxy, it relays user credentials to the legitimate web application the user intends to sign in to, and relays most MFA challenges back and forth between the user and the legitimate web application. This can let attackers capture both user credentials and intercept the session token returned by the legitimate web app to the target’s browser.Real-time phishing campaigns are subsequently capable of bypassing any authentication flow that relies on password and OTPs generated via authenticator apps, or delivered via SMS and email.We’ve observed a steady increase in AiTM capabilities since they were first introduced in 2017. In late 2022, the volume of attacks increased dramatically after these capabilities were made available to a larger number of lesser-skilled actors via services that rent the infrastructure, configuration and phishing templates “as-a-service” at very affordable prices. Phishing-as-a-service has democratized access to what was previously a boutique capability, and attackers of all motivations are making use of it.
The evolution of MFA bypass
The most common forms of MFA bypass are those in which an adversary armed with stolen credentials doesn’t get prompted with an MFA challenge. At times that’s because of some form of misconfiguration: for example, access to Microsoft 365 won’t always require MFA if administrators don’t explicitly deny legacy authentication to Exchange online. Our research shows organizations 50x more likely to get targeted by this type of attack if they don’t get this configuration right.Equally, the theft of session cookies by infostealer malware offers windows of opportunity for attackers to hijack legitimate browser sessions without being presented an MFA challenge.Adversaries can also bypass MFA if they previously compromised a trusted channel for authentication or password reset tokens, such as during SIM swapping attacks or when tokens are sent to a compromised email account. When this happens, the secret used to verify a login event is sent to a device or user account controlled by the attacker.The next most common form of MFA bypass stems from phishing and other forms of social engineering.Most commodity phishing kits are designed to capture the target’s username and password, as well as the one time password (OTP) used to verify the user during an MFA challenge. Phishing kits often pipe these stolen credentials directly to a Telegram channel or some other online forum so as to use them prior to the OTP expiring. When OTPs do expire, we often observe attackers engaging in second-stage social engineering attacks – sometimes calling their target on the phone or engaging in MFA fatigue attacks.However, the phishing attacks that most often lead to an account takeover event work quite differently. They use real-time, adversary-in-the-middle (AiTM) phishing proxies. As with a static phishing campaign, the target gets tricked into entering their credentials into an attacker-controlled phishing site. But when that phishing site also acts as a proxy, it relays user credentials to the legitimate web application the user intends to sign in to, and relays most MFA challenges back and forth between the user and the legitimate web application. This can let attackers capture both user credentials and intercept the session token returned by the legitimate web app to the target’s browser.Real-time phishing campaigns are subsequently capable of bypassing any authentication flow that relies on password and OTPs generated via authenticator apps, or delivered via SMS and email.We’ve observed a steady increase in AiTM capabilities since they were first introduced in 2017. In late 2022, the volume of attacks increased dramatically after these capabilities were made available to a larger number of lesser-skilled actors via services that rent the infrastructure, configuration and phishing templates “as-a-service” at very affordable prices. Phishing-as-a-service has democratized access to what was previously a boutique capability, and attackers of all motivations are making use of it.
