Token Theft: Bypassing Multi-factor authentication

What is the attack and how does it work?

A popular email phishing attack affecting Microsoft 365 users involves bypassing Multi-Factor Authentication Multi-Factor Authentication (MFA) is a security enhancement that requires users to verify their identity using multiple credentials before gaining access to a system, application, or service. This layered approach to security helps ensure that the person requesting access is indeed who they claim to be, significantly reducing the risk of unauthorized access. MFA generally involves a combination of two or more of the following factors: Something you know: A password, PIN, or answer to a security question. Something you have: A physical token, smart card, or a mobile phone to receive a verification code. Something you are: Biometric identifiers, such as a fingerprint, facial recognition, or voice, that uniquely identify the user. By requiring multiple forms of verification, MFA adds an additional layer of defense against potential threats, even if one factor (such as a password) becomes compromised. For instance, even if an attacker obtains a user's password, they would still need the second form of authentication to gain access. In today's digital landscape, where cyber threats are increasingly sophisticated, implementing MFA is a critical step for organizations to protect sensitive data and systems. It enhances security for end-users and across the enterprise, making it a fundamental component of a robust cybersecurity strategy. . The attackers send an email with a link that looks like a PDF document. If you click on the link, you will be taken to a fake website that looks like a typical Microsoft log in site. There, you will be asked to enter your username and password. If you do, the attackers will steal your credentials and your MFA Multi-Factor Authentication (MFA) is a security enhancement that requires users to verify their identity using multiple credentials before gaining access to a system, application, or service. This layered approach to security helps ensure that the person requesting access is indeed who they claim to be, significantly reducing the risk of unauthorized access. MFA generally involves a combination of two or more of the following factors: Something you know: A password, PIN, or answer to a security question. Something you have: A physical token, smart card, or a mobile phone to receive a verification code. Something you are: Biometric identifiers, such as a fingerprint, facial recognition, or voice, that uniquely identify the user. By requiring multiple forms of verification, MFA adds an additional layer of defense against potential threats, even if one factor (such as a password) becomes compromised. For instance, even if an attacker obtains a user's password, they would still need the second form of authentication to gain access. In today's digital landscape, where cyber threats are increasingly sophisticated, implementing MFA is a critical step for organizations to protect sensitive data and systems. It enhances security for end-users and across the enterprise, making it a fundamental component of a robust cybersecurity strategy. token, which means they can access your account even if you have Multi-Factor Authentication Multi-Factor Authentication (MFA) is a security enhancement that requires users to verify their identity using multiple credentials before gaining access to a system, application, or service. This layered approach to security helps ensure that the person requesting access is indeed who they claim to be, significantly reducing the risk of unauthorized access. MFA generally involves a combination of two or more of the following factors: Something you know: A password, PIN, or answer to a security question. Something you have: A physical token, smart card, or a mobile phone to receive a verification code. Something you are: Biometric identifiers, such as a fingerprint, facial recognition, or voice, that uniquely identify the user. By requiring multiple forms of verification, MFA adds an additional layer of defense against potential threats, even if one factor (such as a password) becomes compromised. For instance, even if an attacker obtains a user's password, they would still need the second form of authentication to gain access. In today's digital landscape, where cyber threats are increasingly sophisticated, implementing MFA is a critical step for organizations to protect sensitive data and systems. It enhances security for end-users and across the enterprise, making it a fundamental component of a robust cybersecurity strategy. enabled.

Example:

How can you spot the phishing email?

The phishing email may look convincing, but there are some signs that can help you identify it. Here are some tips to spot the phishing email:

• Check the sender's email address. The phishing email may use a spoofed domain that looks similar to the “original” one, but is not the same. For example, it may use @micros0ft.com instead of @microsoft.com.
• Check the link before you click on it. You can hover your mouse over the link and see the actual URL. The phishing link may use a shortened URL service or a fake domain that looks like Microsoft, but is not the same. For example, it may use https://bit.ly/3zXyZt9 or https://microsoft-login.com instead of https://microsoft.com.
• Check the language and grammar. The phishing email may have spelling or grammatical errors, or use unusual or informal language. For example, it may say "Please open this document urgently" or "Your account will be suspended if you don't verify your identity".

How can you prevent the attack?

The best way to prevent the attack is to avoid clicking on any suspicious links or attachments in emails. If you are not sure about the legitimacy of an email, you can contact the sender directly or report it to your IT department. Intrada clients can submit a ticket at https://www.intradatech.com/helpdesk.

Another way to prevent the attack is to set up a conditional access policy in Microsoft 365. A conditional access policy is a set of rules that control who can access your resources and under what conditions. For example, you can set up a policy that requires users to use a trusted device or a specific network to access your account. This way, even if the attackers steal your credentials and MFA Multi-Factor Authentication (MFA) is a security enhancement that requires users to verify their identity using multiple credentials before gaining access to a system, application, or service. This layered approach to security helps ensure that the person requesting access is indeed who they claim to be, significantly reducing the risk of unauthorized access. MFA generally involves a combination of two or more of the following factors: Something you know: A password, PIN, or answer to a security question. Something you have: A physical token, smart card, or a mobile phone to receive a verification code. Something you are: Biometric identifiers, such as a fingerprint, facial recognition, or voice, that uniquely identify the user. By requiring multiple forms of verification, MFA adds an additional layer of defense against potential threats, even if one factor (such as a password) becomes compromised. For instance, even if an attacker obtains a user's password, they would still need the second form of authentication to gain access. In today's digital landscape, where cyber threats are increasingly sophisticated, implementing MFA is a critical step for organizations to protect sensitive data and systems. It enhances security for end-users and across the enterprise, making it a fundamental component of a robust cybersecurity strategy. token, they will not be able to access your account from an untrusted device or network.  In order to set-up conditional access policies, a licensing plan that includes Entra ID Plan 1 is required.

To learn more about this compromise, you can read the full description from Microsoft here.

If you may have been affected by the compromise or would like help investigating an email, you can submit a ticket by clicking here or call us at 570-321-7370.