sb-nz logo
Story image

Exclusive interview: Major MFA vulnerability discovered in Microsoft’s ADFS

15 Aug 2018

Okta Research and Exploitation (REX) security engineer Andrew Lee has discovered a vulnerability in Microsoft’s Active Directory Federation Services (ADFS) that allows would-be malicious actors to bypass multi-factor authentication (MFA) safeguards, as long as they had full access to another user’s credentials on the same ADFS service.

This is similar to taking a room key for a building and turning it into a skeleton key that works on every door in the building (but in this building each door requires two factors to open).

With the understanding of how most credential phishing attacks work nowadays, this exploit gives an actor an incredible advantage to expand compromises significantly.

Corporations rely on MFA to limit credential attacks, which might lead them to be susceptible to back-of-mind threats such as insider intrusions.

In other words, if just one employee in a massive, global company wanted to – or if a bad actor compromised the account of one employee – they could do a lot of harm by compromising unsuspecting colleagues, senior executives, or even the CEO.

In the discovery of this vulnerability, REX adhered to Okta’s responsible disclosure process to identify the vulnerability and report it to Microsoft.

A fix has been released, but because ADFS is an on-premises solution, customers and IT administrators are strongly encouraged to stay on their toes and patch their systems to ensure the security of their organizations.

SecurityBrief spoke to Okta REX director Mattias Brutti about the vulnerability discovered.

How can the affected parties mitigate the risk this vulnerability presents?

This is a vulnerability on the ADFS service so the only thing people can truly do is apply the patch.

Microsoft has listened to our recommendations and they should be releasing the patch which should solve the vulnerability. 

This is not a vulnerability on Microsoft MFA, this affects every single third-party vendor - including Okta - that provide an agent for ADFS to MFA.

Every single vendor that connects to it, as far as we know, is susceptible to this vulnerability. 

A lot of people rely on Active Directory to integrate between on-premise software and the cloud, you have to use ADFS to build the systems that integrate with other providers such as Okta.  

What communication has Okta had with Microsoft? 

They’ve provided a patch date of August 14 and they also provided us with a CVE (common vulnerabilities and exposures) for it accepting that the vulnerability exists.

This gives us a unique ID for that vulnerability that we can publish and reference.

How does this affect the security of MFA?

MFA has provided us with a unique identifier for each user in order to prevent people from getting phished. 

No matter how good you are with your credentials and how good your security is, people are going to get phished.

Somebody is going to steal your credentials, or even worse.

One of the common techniques that penetration testers (pentesters) use is compromising service accounts during pentests, because the service accounts are real accounts without MFA set up, is take the credentials from the service account, set up an MFA, and then they don’t even need to compromise anyone because after setting up that MFA, they have the MFA for everybody else. 

It lowers the complexity for the attack - you now only need one MFA.

Do you see the industry moving away from MFA after the recent spate of MFA compromises? 

No, this is just a simple mistake.

MFA is something that actually works, it’s great and people should use it all the time, regardless of this vulnerability.

People sometimes take MFA as a silver bullet - it is not a silver bullet.

Like everything else in the industry, it’s prone to vulnerabilities, and the whole point here is that people should patch them and continue to rely on them. 

Story image
SASE vs zero trust – or the best of both worlds
Zero trust and SASE work together by converging a least-privilege access strategy with an architecture that simplifies how highly distributed users, BYOD, and cloud resources are secured.More
Story image
The current state of ransomware — and its future
Discoveries made by analysts at Sophos have unearthed a new development: ransomware code appears to have been shared across ‘families’, and some of the ransomware groups seemed to work in collaboration more than in competition with one another. More
Story image
APAC secure content management market to hit $2.2 billion by 2024
The proliferation of cloud-based deployments will largely drive this, the report says, as the COVID-19 pandemic motivates more enterprises to move their workloads to the cloud and rely more on the internet. More
Story image
Sophos named a Numbering Authority in CVE programme
The programme, which runs an open data registry of vulnerabilities, enables programme stakeholders to correlate vulnerability information used to protect systems against attacks. More
Story image
BackupAssist partners with Wasabi for greater cyber-resilience
This partnership provides customers with an up to 80% less expensive solution that is faster than the competition for achieving enterprise-grade cyber-resilience, the company states. More
Story image
Cybersecurity spending to increase following SolarWinds hacking
Hackers breached software provider SolarWinds, directly infecting the company’s Orion software as well as several local, state and federal agencies.More