Non-human identity management firm Oasis Security has disclosed the details of an attack that allowed its researchers to bypass Microsoft’s multi-factor authentication (MFA) implementation.
The attack method, dubbed AuthQuake, was reported to Microsoft in late June and a temporary fix was rolled out a few days later. The tech giant released a permanent fix in October.
According to Oasis, the vulnerability, which is described as critical, could have allowed threat actors to bypass Microsoft’s MFA and gain access to accounts — provided that they had the target’s username and password.
The security firm noted that the MFA bypass could have been exploited to access Outlook emails, OneDrive files, Teams chats, and Azure cloud instances, and highlighted the potential impact by pointing out that Microsoft recently reported having more than 400 million paid Office 365 seats.
Oasis said the AuthQuake bypass method was dangerous because it only took (on average) an hour to execute, it required no user interaction, and it would not trigger any notification to the victim.
When using an authenticator app to obtain the six-digit code needed for MFA during a login attempt, one session supports up to 10 failed attempts, to prevent brute-force attacks.
However, Oasis researchers discovered that an attacker could execute multiple attempts simultaneously, enabling them to go through possible combinations relatively fast.
In tests conducted by the researchers, they found that each MFA code generated by the app is valid for roughly three minutes, which meant a 3% chance for the attacker to guess the correct code. After the three minutes were up, the attacker could initiate another session, and the process would be repeated until a correct code was guessed — and the victim would not see any signs of an attack attempt during this time.
The tests showed that the chances of guessing the correct code after 24 sessions (which took roughly 70 minutes) exceeded 50%, and in some cases the code was guessed quickly, as demonstrated in a video showing the exploit in action.
Regarding Microsoft’s fix, Oasis noted, “While specific details of the changes are confidential, we can confirm that Microsoft introduced a much stricter rate limit that kicks in after a number of failed attempts, and the strict limit lasts around half a day.”
Related: Google Cloud Rolling Out Mandatory MFA for All Users
Related: MFA Isn’t Failing, But It’s Not Succeeding: Why a Trusted Security Tool Still Falls Short
