TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA

228 pointsby nevirabout 3 years ago

20 comments

petilonabout 3 years ago
Microsoft's MFA is terrible. You install an app called Authenticator. Then when you login the Authenticator app gets a push notification, and the user has to say whether to allow the login or not. If you accidentally press Yes, the attacker gets in. And here's why this is a serious problem: When you use Remote Desktop to work, any time you have a network issue RDP automatically reconnects and you get an Authenticator notification. So during the work day you get frequent prompts that are automatically initiated by RDP reconnects. You get used to automatically saying Yes to the prompt. So when one of these prompts is initiated by an attacker's login there is no way to know, and you automatically answer Yes.
评论 #30860256 未加载
评论 #30861662 未加载
评论 #30860010 未加载
评论 #30859250 未加载
评论 #30861837 未加载
评论 #30867391 未加载
评论 #30859502 未加载
评论 #30865358 未加载
评论 #30864737 未加载
评论 #30864670 未加载
评论 #30859620 未加载
评论 #30860377 未加载
评论 #30860189 未加载
评论 #30861608 未加载
评论 #30859456 未加载
评论 #30863786 未加载
评论 #30865196 未加载
kokaneeabout 3 years ago
I'm always on the edge of my seat waiting to learn what mind-blowing technique the "band of elite hackers working for Russia’s Foreign Intelligence Service" came up with. And it's always something along the lines of "they kept sending emails until somebody clicked the link."
评论 #30859113 未加载
评论 #30860531 未加载
评论 #30858581 未加载
评论 #30859697 未加载
评论 #30859618 未加载
exabrialabout 3 years ago
Crusty person with an opinion here.<p>Google wankers forcefully added &quot;Google Prompts&quot; as a 2FA method, without consent, and disabled removing it. Of course people are going to hit &quot;authorize&quot;. Oh and if you remove the Google app, you can thankfully use the YouTube app (like that&#x27;s a good idea). A _video streaming_ app now has the keys to the kingdom. Man I feel secure.<p>Just use hardware keys. It&#x27;s not difficult. My 70 year parents use them. I explained &quot;This is like your front door key, but for you account. It&#x27;s safe to put this in whenever the computer prompts you for it.&quot;
评论 #30859082 未加载
评论 #30858908 未加载
评论 #30861305 未加载
morpheuskafkaabout 3 years ago
I would expect that an engineer would recognize that (1) a massive volume of MFA notifications is extremely suspicious and should be reported immediately to security and (2) if they are trying to sleep they can just mute or turn off the phone. This was a major failure of training.<p>For a nontechnical employee I could get how they could not recognize this as an attack. But if you are getting annoying calls and don&#x27;t know why, why not just unplug&#x2F;turn off the phone?<p>On the other hand, slipping a single MFA notification in during the normal workday seems like a much better approach. Even if the employee doesn&#x27;t accept the notification, they&#x27;d likely assume that it was a tab they opened earlier and closed before finishing the login, not something to report.
评论 #30858786 未加载
评论 #30858460 未加载
评论 #30859255 未加载
评论 #30861587 未加载
评论 #30858525 未加载
评论 #30860635 未加载
pkulakabout 3 years ago
I&#x27;ve noticed that Google actually randomizes the position of the Accept and Deny buttons on their 2FA popups. I guess this is to force you to read the entire text, but I have on more than one occasion Deny&#x27;ed my own request because of this. I think someone would have to hit me with about 4 2FA requests before I ham fisted the wrong button.
JumpCrisscrossabout 3 years ago
&gt; <i>no limit is placed on the amount of [2FA phone] calls that can be made</i><p>I thought this was going to be a story about one-time password interception [1]. Instead, it&#x27;s something much, much dumber.<p>[1] <a href="https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2021&#x2F;09&#x2F;the-rise-of-one-time-password-interception-bots&#x2F;" rel="nofollow">https:&#x2F;&#x2F;krebsonsecurity.com&#x2F;2021&#x2F;09&#x2F;the-rise-of-one-time-pas...</a>
TheDudeManabout 3 years ago
&gt; That’s where older, weaker forms of MFA come in. They include one-time passwords sent through SMS or generated by mobile apps like Google Authenticator<p>That reference to Google Authenticator being weaker is not consistent with the rest of the article.
评论 #30860351 未加载
rmsaksidaabout 3 years ago
Isn&#x27;t manual TOTP MFA (using codes generated by Google Authenticator or similar) significantly more secure than those MFA prompts? I don&#x27;t understand the push for MFA prompts when the previous technology worked just fine and was probably more secure. What&#x27;s the benefit to MFA prompts other than slightly better UX?
评论 #30859693 未加载
评论 #30859108 未加载
评论 #30858771 未加载
vinay_ysabout 3 years ago
Currently I only trust these 3 factors of authentication used in combination correctly:<p>1. Memory (enter the site-specific password via the password manager which is unlocked by a password is from your memory).<p>2. Device (device-internal-hardware backed certificate bound to this device).<p>3. Physical Presence (FIDO2 Key touch)<p>Most importantly, it is extremely important how secure the reset auth flows is. And if any <i>one</i> of the three factors need to be reset, then the system should require the other two to be valid, plus it should require an in-person identity verification (if implemented correctly, video KYC should be acceptable). Plus there should be a reset-buddy designated by the user who should second&#x2F;vouch the user&#x27;s initiation of reset.<p>Without all of these (2 factors of auth from the user plus system automated video kyc + reset-buddy vouching), even the admin shouldn&#x27;t be able reset auth of any accounts. This is crucial.<p>Plus there should be a pre-cooloff period after reset request is raised but before it is actually processed, and a post-cooloff periods for any additional factor reseting, and regaining full privileges.<p>Independently, there should be fraud&#x2F;risk systems for safeguarding any sensitive operations (like creating additional users, exfiltration of data etc).
评论 #30861074 未加载
linuxhanslabout 3 years ago
I gave a talk on that almost 20 years ago...<p>Basically you have (1) something you know (like a password), (2) something you have (like some device or key), and (3) something you are (like a fingerprint and iris scan).<p>Back then the accepted trade-off was that have any two of these three is good enough for most case, and for really critical stuff you need all three.<p>The MFAs in question here attempt (1) and (2), but do a bad job on (2).
habiburabout 3 years ago
If they could login without knowing the password when MFA is enabled, then 2FA&#x2F;MFA is making it less secure than simply having a strong password and nothing else.
评论 #30859580 未加载
评论 #30859516 未加载
jgrahamcabout 3 years ago
Use hardware tokens. FIDO2 works.
Plasmoid2000adabout 3 years ago
Some of this is expectations and how you train your users I think.<p>I know at least in my experience, running a Windows machine I can get random prompts to sign-in at random times from Outlook, Team, Visual Studio for Azure resources, from powershell scripts with zero context as to what they are for.<p>Some of them will prompt for login, as I have multiple AAD account, others will just pick one AAD account and skip the password as things are cached.<p>I&#x27;m then getting seemingly phantom login prompts and phantom authenticator requests by design. I&#x27;m denying them when I&#x27;m not certain what they are, and for secure environments I&#x27;m using a yubikey - but that&#x27;s not what I expect most people to do faced with this.
kyle-rbabout 3 years ago
Can&#x27;t wait until companies expand their fake-phishing email programs to include this. Randomly like once a month your phone will get spammed at 1am and if you allow the request, then you have to attend a phishing training session.
kobalskyabout 3 years ago
this reminds me of Interactive Broker&#x27;s iOS MFA.<p>if someone tries to login and you happen to be using their app, the face ID triggers automatically without prompting you to accept.<p>you would have to be very fast to point the phone away from your face to avoid it.
cratermoonabout 3 years ago
One job I worked on involved updating my employer&#x27;s authentication and bringing in MFA and other modern authentication techniques. We initially enabled just the MFA that required the use to have an authenticator app and enter the code into the site along with their password. Guess what? That didn&#x27;t satisfy the product owner or marketing, so we were required to enable the other form of MFA, which sends a message to the user&#x27;s device and requires them to just press the OK on the app and allow it.<p>But at least we were able to hold the line on sending one-time codes via SMS.
Klasiasterabout 3 years ago
No one external should be able to trigger this, it should only be the owner that takes action of, e.g., opening a code generator or requesting an SMS&#x2F;phone call through dialing from the right number.
PUSH_AXabout 3 years ago
The article seems to lump Google Authenticator and push style authentication prompts together (as old broken MFA), but I&#x27;m unsure how you spam someone with requests for the former?
m00dyabout 3 years ago
&gt; MFA Request Bombing<p>Has anyone experienced this personally ?
评论 #30860562 未加载
ffhhjabout 3 years ago
Wasn&#x27;t the same old trick SIM swapping?
评论 #30859239 未加载