Critical AuthQuake Vulnerability Exposes 400M Office 365 Accounts

In a shocking revelation, Oasis Security's research team has uncovered a critical vulnerability in Microsoft’s Multi-Factor Authentication (MFA) system that poses a severe risk to the security of over 400 million Office 365 accounts. Dubbed “AuthQuake,” this flaw allows malicious actors to bypass MFA protections, potentially granting them unauthorized access to sensitive data—ranging from Outlook emails to OneDrive files and even Azure Cloud resources. Let's unpack this serious security breach and what it means for users and businesses.

What is the AuthQuake Vulnerability?​

At its core, the AuthQuake vulnerability exploits weaknesses inherent in the time-based one-time password (TOTP) system employed by Microsoft. The glitch derives primarily from two critical deficiencies:

• Lack of Rate Limiting:
  Attackers were able to create multiple sessions rapidly, pressing their luck with a barrage of potential code combinations. With the system permitting numerous simultaneous tries, they could quickly exhaust all possible six-digit codes.
• Extended Code Validity:
  Traditionally, TOTP codes are valid for about 30 seconds to mitigate the risk of interception. However, in this case, the codes retained their validity for nearly 3 minutes. This expansive time window granted attackers a substantial opportunity to guess right—especially considering the success rate surged past 50% during tests.

Alarmingly, the exploit required no user interaction and generated no alerts, meaning victimized users remained blissfully unaware as their accounts fell prey to attackers.

The Attack Method​

Here's how attackers leveraged the AuthQuake vulnerability:

• Session Initiation: Attackers began by creating numerous sessions using identical parameters.
• Brute-Force Attempts: By initiating numerous session attempts in quick succession, they could enumerate TOTP codes at an alarming speed.
• Long Code Validity Exploit: The extended validity for codes not only granted a larger attack window but also compounded the likelihood that attackers could correctly guess a code before it expired.

Microsoft's Response and Mitigations​

Upon being alerted by Oasis Security, Microsoft acted decisively:

• June 24, 2024: Microsoft acknowledged the vulnerability.
• July 4, 2024: A temporary fix was deployed to curb the immediate threat.
• October 9, 2024: A permanent solution involving stricter rate-limiting mechanisms was implemented. These new protections come into play following several failed attempts and can last up to half a day, significantly thwarting brute-force attacks.

While the vulnerability has been addressed, the incident underscores the need for robust MFA practices.

Recommendations for Enhanced Security​

Given the current landscape of digital threats, the following measures are recommended for organizations and individuals to bolster security:

• Implement Stricter Rate Limiting: Proactively limit failed authentication attempts to impede brute-force strategies effectively.
• Monitor Failed MFA Attempts: Manual or automated alerts for repeated failures can serve as an early detection system for suspicious activity.
• Regular Security Audits: Periodically review security measures to pinpoint and amend weaknesses in systems.
• User Education: Regular training about the importance of MFA and best practices fosters a culture of security awareness.

Despite this vulnerability, MFA remains an essential pillar of digital security. Organizations should continue to implement MFA, using authenticator applications and stronger passwordless methods while retaining vigilance for emerging vulnerabilities.

Conclusion​

The AuthQuake vulnerability serves as a stark reminder of the complexity and necessity of maintaining robust security measures in our increasingly digital world. While attackers are continually honing their skills, the need for solid defenses—especially in widely used applications like Office 365—has never been more critical.

How Should You Proceed?​

With the lessons of AuthQuake fresh in our minds, consider this your wake-up call: Are your account security measures up to par? Adopting vigilant and adaptive security practices is no longer optional; it’s essential for protecting both personal and business data against ever-evolving threats. Embrace multi-factor authentication, but do so wisely. Stay informed, stay protected.

---

Source: Cyber Security News Microsoft Azure MFA Vulnerability Allows Unauthorized User Account Access