Clever Phishing Attack Bypasses MFA to Nab Microsoft Office 365 Credentials – Expert Reaction

Cofence has discovered an attack that bypasses MFA to nab Microsoft 365 credentials. Researchers at Cofense Phishing Defense Center discovered the tactic, which leverages the OAuth2 framework and OpenID Connect (OIDC) protocol and uses a malicious SharePoint link to trick users into granting permissions to a rogue application, researcher Elmer Hernandez wrote in a blog post published Tuesday.

Experts Comments

May 21, 2020
Dan Conrad
Field Strategist
One Identity
This is a very well-crafted phish as it “front ends” O365 with a malicious SharePoint site. When the user authenticates to O365 it grants this site access to the user's data. It goes beyond the simple gaining of a user’s password and possibly moving laterally or elevating privilege. From an attacker’s perspective, this type of effort would be used for specific targets (aka “whaling”), where they would attempt to get specific account information from specific, high-level users......Read More
This is a very well-crafted phish as it “front ends” O365 with a malicious SharePoint site. When the user authenticates to O365 it grants this site access to the user's data. It goes beyond the simple gaining of a user’s password and possibly moving laterally or elevating privilege. From an attacker’s perspective, this type of effort would be used for specific targets (aka “whaling”), where they would attempt to get specific account information from specific, high-level users. It’s a bit like a man-in-the-middle, but for O365. Once authenticated, they would have access to anything stored on the O365 platform such as corporate email, contacts, OneDrive, etc., which they can take and hold for ransom or use maliciously. As organisations train users on phishing and who is after their identities, attackers are learning as well. This attack underlines the importance of separating privileged credentials from standard user credentials. Any account with elevated permissions should not be “phishable”.  Read Less
May 21, 2020
Niamh Muldoon
Senior Director of Trust and Security EMEA
OneLogin
Phishing is the mechanism for malicious attackers to gain access to organisation networks and/or systems and malicious attackers are moving away from traditional delivery mechanisms of phishing links such as email. This new type of attack demonstrates that multi-factor authentication alone is not enough to protect against increasingly sophisticated phishing attacks and now even traditional forms of 2 Factor Authentication using something you know, like a password, whilst having tokens or pins, .....Read More
Phishing is the mechanism for malicious attackers to gain access to organisation networks and/or systems and malicious attackers are moving away from traditional delivery mechanisms of phishing links such as email. This new type of attack demonstrates that multi-factor authentication alone is not enough to protect against increasingly sophisticated phishing attacks and now even traditional forms of 2 Factor Authentication using something you know, like a password, whilst having tokens or pins, like an SMS and One-time-password, are at risk. Multi-factor authentication using the something you are component (biometrics) reduces this risk. Leaders Digital Identity space are using AI to model user behaviours for access to systems and data, if a user’s risk profile changes then so do does their authentication mechanism along with ability to execute privileges, this makes it more complex and difficult for malicious attackers to be successful in gaining access.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Share on facebook
Share on twitter
Share on linkedin

Recent Posts

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts