Hackers Bypassing MFA To Access Cloud Accounts, Warn CISA

The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of a worrying development with hackers exploiting poor cyber hygiene practices within a victims’ cloud services configuration.

Indeed, CISA warned on Wednesday hackers are bypassing multi-factor authentication (MFA) authentication protocols in order to compromise cloud accounts.

The warns comes after outgoing US President Donald Trump in November fired Chris Krebs, the widely respected CISA director, after he disagreed publicly with Trump’s allegation of voter fraud.

MFA bypass

CISA this week however has warned that hackers are increasingly targeting corporate and personal laptops with phishing, brute force login attempts and possibly a “pass-the-cookie” attack to access cloud accounts.

“CISA is aware of several recent successful cyberattacks against various organisations’ cloud services,” said the federal agency. “Threat actors used a variety of tactics and techniques, including phishing and brute force logins, to attempt to exploit weaknesses in cloud security practices.”

“In response, CISA has released Analysis Report AR21-013A: Strengthening Security Configurations to Defend Against Attackers Targeting Cloud Services which provides technical details and indicators of compromise to help detect and respond to potential attacks,” it added.

According to CISA, some hackers have spoofed file hosting services and other legitimate vendors in phishing emails in order to harvest log-ins. They then use use those hijacked accounts to phish others in the organisation.

And it seems that although multi-factor authentication (MFA) has thwarted some attempts to brute force accounts, in at least one incident, the hackers were able to successfully sign into a user’s account, eventhough the target had multi-factor authentication (MFA) enabled.

CISA warned the hackers were able to defeat MFA authentication protocols as part of a ‘pass-the-cookie’ attack.

This involves hackers hijacking an already authenticated session using stolen session cookies to log into online services or web apps.

Multi-layered security

The development has prompted some response from security experts.

“Cybersecurity is multi-layered and if some layers are misunderstood, misused, or neglected, one single vulnerability has the potential to cause disastrous consequences,” explained Tom Van de Wiele, principal consultant at F-Secure.

“The most common example is the use of Multi-Factor Authentication (MFA) by organisations to protect against phishing, where most MFA solutions are only effective against attacks such as password guessing, brute-forcing or credential stuffing,” added Van de Wiele.

“Knowing that applications and IT architectures consist of a lot of moving parts and are subjective to constant change, regular testing for these kinds of scenarios as part of application and architecture-based security reviews and assessments are crucial to ensure that these scenarios cannot play out now or in the future,” he concluded.

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

NHS Challenged Over Data Contract With Palantir

Contract between NHS and data mining firm Palantir now at centre of lawsuit filed by…

49 mins ago

California Can Enforce Its Own Strict Net Neutrality Law

Open Internet Victory? Ruling from US federal judge rejects attempt by US broadband providers to…

2 hours ago

Australia Passes Amended ‘Media Bargaining Law’

Australia becomes first country in the world where a government arbitrator can set prices tech…

5 hours ago

Facebook Oversight Board Confirms Appeal Over Trump Ban

Unnamed 'user' files appeal with Facebook's Supreme Court (the Oversight Board) against the 'indefinite' ban…

6 hours ago

Facebook To Invest $1 Billion In News Industry

After the very public row with the Australian government, Facebook confirms it is investing $1…

24 hours ago

EU Opens Consultation On Gig Economy Worker Rights

After UK's top court rules Uber drivers are workers, European Commission begins consultation on gig…

1 day ago