The New Reality: Why MFA Alone Won’t Protect Your Business in 2024

 

Everybody now knows that the original security measure, the simple username-password combination, has proven increasingly inadequate in safeguarding yourself online. Passwords and PINs, once the cornerstone of online security, have become vulnerable to a range of risks when used on their own.

Consequently, alternative authentication methods were needed, and Multi-Factor Authentication (MFA) was born.

These security measures include SMS/email one-time passcodes, authenticator apps, and biometric technologies like touch ID (fingerprints) and face ID on phones.

MFA security should now be a non-negotiable requirement for businesses (and individuals alike). Today, basic MFA is considered a baseline security measure, and businesses that fail to implement it across all their work applications are left exceptionally vulnerable to cyber threats.

Such is its importance, that we here at Lumina will not even offer support to a business that refuses to have MFA.

However, MFA alone is now not enough.

Inevitably, as both technology and cybercriminals have evolved, using the traditional MFA methods mentioned above are no longer enough to keep you safe. Just as the username-password combination eventually needed additional security measures around it, now too does MFA…

Because traditional MFA can now be bypassed:

Methods like time-based one-time passcodes (TOTP), which generate a new security code every 60 seconds via a separate authenticator app, were considered robust due to their dynamic nature.

However, cybercriminals have found ways to bypass these measures, typically with a type of phishing attack referred to as session token theft.

In simpler terms, when you satisfy the MFA requirements and authenticate to a service (like Microsoft etc), that service creates a session token.

That token becomes your passkey for your session and as long as the token remains valid, you will not be prompted to reauthenticate. Anyone in possession of that token can access the services to which the token applies.

Imagine that you have day tickets for Glastonbury.

When you enter the festival venue, you show security your ticket, and in exchange, you’re given a special wristband. Anyone wearing the wristband can access the festival facilities and wander around unchallenged. The wristband could be taken from you without your knowledge and the thief could then also wander around the park unchallenged, as once you have the wristband, security will not ask to see the original tickets.

The Glastonbury tickets are like security measures such as the username-passwords and MFA, and the wristband is like a session token. You satisfy the security requirements (show your tickets) and are granted a session token (a wristband).

Cybercriminals can now exploit businesses by stealing these session tokens to bypass traditional MFA security measures and gain unauthorised access to sensitive company resources. Once inside, this can lead to theft of confidential data and intellectual property, and extortion.

This then poses significant risks to the business and potentially its clients as well.

How can hackers steal a session token?

It all starts with a [very convincing] phishing email.

Here is a step-by-step example of how session token theft can occur with a phishing email and a link to a document:

1. The user will receive a seemingly genuine phishing email with a link to a document.
2. They click on it and to view the document, they are prompted to sign into their Microsoft account – the login will look like a legitimate Microsoft login because they are actually logging in to Microsoft…but there is a catch – the attacker is proxying the Microsoft login page via their own web server.
3. The user will enter their login details that will go via the attacker.
4. The Microsoft site will then generate an MFA prompt which will be displayed to the user through the proxied session via the attacker.
5. The user will then use their authenticator app and satisfy the MFA requirements.
6. The Microsoft server will then generate the session token and send it back to the user (still via the attacker’s proxy).
7. The attacker will steal a copy of the session token as it passes through.
8. As the session token is still delivered to the user and the login is completed successfully, no suspicions are raised, and it appears like a genuine login.
9. As the attacker now has a copy of the session token, they can load it up onto their device at any point and gain access to the user’s Microsoft account without being prompted to re-enter credentials, and therefore be able to access all data the user is authorised to view.

 

This type of phishing attack is often referred to as Adversary-in-the-Middle (AitM) due to the nature of the attacker acting as a ‘middle man’ between the user and Microsoft.

Session token theft allows criminals to bypass MFA because the session token that was stolen was created after the security credentials had been checked. When the session token is loaded up onto the attacker’s device, there are no MFA prompts because the session token will signal that this has already been done.

So how can you stop these types of AitM phishing attacks?

There are approximately 30 billion devices in the world today. Your system needs to know that it really is you, or anyone authorised, that is attempting to access company resources.

New anti-phishing technologies can now help with this.

Here at Lumina, we are rolling out these new anti-phishing security measures to all of our clients.

But what are they and how can I begin to upgrade my security?

Our white paper with all the solutions we are using has now been released and you can download it by clicking the button below!