Cofence has discovered an attack that bypasses MFA to nab Microsoft 365 credentials. Researchers at Cofense Phishing Defense Center discovered the tactic, which leverages the OAuth2 framework and OpenID Connect (OIDC) protocol and uses a malicious SharePoint link to trick users into granting permissions to a rogue application, researcher Elmer Hernandez wrote in a blog post published Tuesday.
Phishing is the mechanism for malicious attackers to gain access to organisation networks and/or systems and malicious attackers are moving away from traditional delivery mechanisms of phishing links such as email.
This new type of attack demonstrates that multi-factor authentication alone is not enough to protect against increasingly sophisticated phishing attacks and now even traditional forms of 2 Factor Authentication using something you know, like a password, whilst having tokens or pins, like an SMS and One-time-password, are at risk.
Multi-factor authentication using the something you are component (biometrics) reduces this risk. Leaders Digital Identity space are using AI to model user behaviours for access to systems and data, if a user’s risk profile changes then so do does their authentication mechanism along with ability to execute privileges, this makes it more complex and difficult for malicious attackers to be successful in gaining access.
This is a very well-crafted phish as it “front ends” O365 with a malicious SharePoint site. When the user authenticates to O365 it grants this site access to the user\’s data. It goes beyond the simple gaining of a user’s password and possibly moving laterally or elevating privilege. From an attacker’s perspective, this type of effort would be used for specific targets (aka “whaling”), where they would attempt to get specific account information from specific, high-level users. It’s a bit like a man-in-the-middle, but for O365. Once authenticated, they would have access to anything stored on the O365 platform such as corporate email, contacts, OneDrive, etc., which they can take and hold for ransom or use maliciously.
As organisations train users on phishing and who is after their identities, attackers are learning as well. This attack underlines the importance of separating privileged credentials from standard user credentials. Any account with elevated permissions should not be “phishable”.