Introduction
Multifactor authentication (MFA) is one of the most important security solutions applied to deal with attackers stealing passwords, and It proved to be a decent way of dealing with it.
Nowadays, techniques to even bypass the MFA, this is done by making the user log in to the fraud website that is communicating with the real website through a server that the attacker prepared before (reverse proxy), and when the user attempts to log in, the credentials the user provided will be captured (seems like normal phishing right?), after the user successfully logs in, the server will capture the session tokens and save them so the attacker can then log in using them, and since these are session tokens the attacker won’t be prompted to enter creds or satisfy MFA.
Example to showcase how it’s done:
First, a domain is needed to use as the phishing domain in my case I chose “Microsoftonlin.con”, you can use any domain you own but in my case, I was running everything locally so I wasn’t limited to a domain as I was using the local DNS to resolve the domains, and this explains as well why it’s telling you the website insecure as I wasn’t using a SSL certificate, if this was running on a public server I could’ve used a trusted certificate to look more legitimate.
The target will be “office365”, I did the server setup based on that and the phishing URL came out as “https://login.office.microsoftonline.com/SWeAbILX”, which will redirect the user to the following page:
After some time we will be redirected to the following page:
As this is talking with the real O365, wrong credentials will be detected.
Using legitimate credentials to log in will redirect us to the following page requesting MFA code:
We can see here that the user has logged in into O365 even though the domain in the URL didn’t change.
The credentials and the session tokens are captured in the attacker server.
To impersonate the victim, the attacker will have to go into the legitimate O365 log in page, delete all the cookies and insert the cookies stolen from the victim:
Importing the new cookies:
Refreshing the page after importing the cookies will log us in as the victim user
By now the user’s account is fully compromised. It’s always been tricky to deal with phishing attacks as it’s mostly dependent on the user’s awareness.
Conclusion
The sophisticated techniques demonstrated in bypassing MFA highlight a critical vulnerability in our digital security frameworks. While MFA adds an essential layer of protection, it’s not infallible. This underscores the importance of continued vigilance and education in cybersecurity practices. Users must be aware of the evolving tactics used by attackers and remain cautious, especially when engaging with unfamiliar or suspicious websites. As technology advances, so do the methods of exploitation, making it imperative for both individuals and organizations to stay informed and proactive in safeguarding their digital assets.
