Unauthenticated

Despite years of trying, Microsoft says only 22% of Azure Active Directory customers have adopted multi-factor authentication. Its new Cyber Signals report underlines the scale of attempts to compromise online accounts. "From January 2021 through December 2021, we've blocked more than 25.6 billion Azure AD brute force authentication attacks and intercepted 35.7 billion phishing emails with Microsoft Defender for Office 365," it says. We'd be the first to accept rolling out MFA can be challenging, but the effort is worth it. This week, Google said it had automatically enabled two-step verification for over 150 million people and this resulted in a 50% decrease in accounts being compromised compared to those not enrolled.

Multi-factor authentication is essential, but it's not foolproof - and attackers are constantly developing new ways to bypass it. Proofpoint has details of three new phishing kits specifically designed to overcome MFA. They work by exploiting a key element of the MFA process; the session cookie. They steal this by sitting between the user and their destination. This allows the attackers to harvest the user's credentials as they're entered. These are forwarded to the destination which issues a session cookie in return. The attacker intercepts that and forwards it to the user, but not before copying it and thus gaining access to the targeted account without the need for credentials or MFA.

As Proofpoint points out, kits like these have been around for years but little has been done to combat them. Proofpoint describes them as an "industry blind spot". It cites research from Stony Brook University and Palo Alto Networks that developed an automated tool to identify the reverse proxies used by the kits. The result; more than 1200 phishing sites. There's not much a user can do to prevent such attacks, but the research does suggest a number of potential mitigations, including using a separate channel to manage the second authentication factor.