Hardening Measures for Multi-Factor Authentications

Authentication plays an important role in any system nowadays. It verifies whether someone is in fact who claims to be. Basic authentication comes in form of password but for some time now, Multi-Factor Authentication (MFA) as been seen as a standard and a “must have” since it provides extra protection. MFA can be implemented and used in many ways like physical tokens, biometrics, software apps, SMS and more.

Since not everyone is aware of tokens or biometrics as a means to perform MFA, app-based methods are being adopted as a safer way to authenticate users instead of SMS’s or phone calls. A tendency that is growing according to Microsoft.

Basic MFA functioning relies on One-Time Passwords (OTP). Software apps like Authy or Microsoft Authenticator have implemented cryptographic hashing functions such as Hash-based Message Authentication Code (HMAC) to generate OTPs, that usually are composed by a 6-digit number, computed with a timestamp and a secret key.

In order to use a Multi-Factor Authentication, three factors must be considered and two of the three are required.

Those factors are:
a) Something you know. This method is based on the usage of a password or passphrase, a PIN or the answers to secret questions (challenge-response). It involves verification of something provided by the user.
b) Something you have. This can be a token device, a smartcard, an e-mail, a cell phone number or a smartphone in combination with an OTP software app. It involves verification of an item that the user has in their possession.
c) Something you are. Like fingerprint, facial or voice recognition, retina or iris scan. This method involves verification of characteristics inherent to the individual.

The subject of MFA has been suffering changes in order to become robust over the years. Malicious actors continue to discover new ways of compromising the authentication process as it has been seen most recently by groups like Lapsus$ that take advantage of the state of the fatigue of the users.

Considering the basic functioning of the concept, the following are five hardening measures that enhance the use of corporate MFA. The measures are based on currently best practices and recent forms of exploitation, employed by adversaries today.

1. Disable MFA Default Configuration for text messages

SMS as MFA tends to be widely used because it is easy to configure and only requires a phone number to receive the OTP. This out-of-band authentication is considered the weakest form of MFA and companies like NIST and Microsoft consider it deprecated and have been increasingly advising to leave aside its usage.

This type of MFA is vulnerable to SIM Swapping, does not rely in encryption, can be intercepted using software-defined-radios, FEMTO cells or SS7 intercept services, is phishable and can be brute-forced.

Changing the authentication process to physical tokens, biometrics or software based-app is highly recommended.

2. Disable Pop-Up Notifications to Avoid MFA Fatigue Attack (MFA Bypass)

Recently, threat actors, like the Lapsus$ group, have begun looking for ways to compromise what should be a security enhancing practice like app-based authentication. After threat actors obtaining valid credentials, they have been successfully compromising accounts with spamming/bombing push notifications by exploiting “MFA Fatigue”.

“MFA Fatigue” can be seen as a second factor authentication bypass and the modus operandi of the threat actors concerns the overload of notifications a user receives during a day to perform logins or approve different actions. With the overwhelming volume of notifications, fatigated users try to dispatch whatever pop-ups are upseting them and start putting security best practices aside.

Since the Covid-19 era, the overwhelming mobile pop-ups and notifications have increased considering that different business models have turned to remote work and enabled Virtual Private Network (VPN) to access internal resources.

With all the considerations declared, the attack is not particularly effective due the technology but the human state of constant attention in the context of the excessive number of notifications. Fatigated users tend to accept notifications when they want to make them disappear, and many MFA users are not familiar with this attack due its recent exploitation which ends in some cases in the approval of fraudulent notifications.

In sum, this type of MFA exploits the fatigue and human attention.

It is advised disabling pop-up notifications.

3. Block User Account After Several MFA Denials

Nowadays, most compromised accounts come from gathering passwords from data breaches and performing password stuffing attacks. Considering people use software app-based or SMS for the MFA, threat actors may abuse the OTP authentication by brute-forcing it.

In this sense, it is not common to find security controls by default to restrict the abuse of OTP authentication. Whenever possible, every account should be configured to be blocked or to initiate a password recovering process after a certain number of MFA denials occur.

App-based MFA is vulnerable to brute-force, phishing and malware running in the victim’s device.

In this context, configuring a maximum number of MFA denials should be a necessary rule.

4. Block Access By Location

Foreigner origins not expected for daily labour should not be used for authentication. For example, in a scenario with no restrictions implemented, a threat actor after gathering a pair of credentials from a data breach and that bypasses the MFA using the MFA Fatigue attack, would not have his location as an obstacle, however distant might be, to successfully compromise the victim’s account.

Blocking accesses by location consistently reduces the authentications allowed which consequently reduces the attack’s surface.

In summary, it is advised enabling authentication only for the countries known for daily work. Authentications from countries not recognized by the company as legitimate, should be blocked.

5. Configure Physical Token or Biometric Authentication

Physical tokens and biometric authentications use FIDO U2F protocol for authentication. The protocol is designed to act as a second factor to strengthen the username/password-based login flows. It uses public-key encryption, which means that for each service used, a new pair of keys is generated and an unlimited number of services can be supported, all while maintaining full separation between them to preserve privacy.

The U2F protocol can be used in 3 ways.
1. Passwordless or tokenless: the user just needs to unlock the device using biometrics.
2. For mobile: the user inserts the username and password and then touches the registered physical token. The communication between the token and the registered devices is made via NFC or bluetooth.
3. For USB: the user types the username and password, inserts the physical token into the computer and touches the button.

The U2F protocol also guarantees that the user login is bound to the real site. In other words, the authentication will fail on a fake site even if the user is convinced it was real. In short, the origin binding mitigates most of the attack’s surface, including sophisticated phishing attacks.

For the token usage, this type of MFA is vulnerable to hardware theft. For this purpose it is advised having a second physical token as backup stored in a safe location.

Author: André Monteiro – Cipher Cybersecurity Auditor, Portugal.

References

https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf

Disable MFA Default Configuration for text messages:

https://danielmiessler.com/blog/casmm-consumer-authentication-security-maturity-model/
https://www.pcisecuritystandards.org/pdfs/Multi-Factor-Authentication-Guidance-v1.pdf
https://www.forbes.com/sites/zakdoffman/2020/11/17/microsoft-warning-about-sms-security-codes-sent-to-apple-iphone-and-google-android-phones/
https://www.zdnet.com/article/microsoft-urges-users-to-stop-using-phone-based-multi-factor-authentication/

https://blog.mozilla.org/en/internet-culture/mozilla-explains/mozilla-explains-sim-swapping/

https://privacypros.io/u2f/sim-swapping/

Disable Pop-Up Notifications to Avoid MFA Fatigue Attack (MFA Bypass)

https://www.gosecure.net/blog/2022/02/14/current-mfa-fatigue-attack-campaign-targeting-microsoft-office-365-users/
https://www.mandiant.com/resources/russian-targeting-gov-business
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-phone
https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/

https://twitter.com/_mg_/status/1506743225813331969

Configure Physical Token or Biometric Authentication

https://www.yubico.com/resources/glossary/fido-u2f/
https://www.yubico.com/authentication-standards/fido-u2f/

https://inteltechniques.com/book7.html