A design flaw affecting the Microsoft Authenticator is locking users out of their MFA-protected accounts, causing chaos as staff spend hours troubleshooting the issue with IT helpdesks.
Originally reported by CSO Online, the issue occurs when users attempt to add a new account by scanning a QR code, now the most popular way to quickly add an account, but when using this method, the authenticator will overwrite any account with the same username as the new entry.
This stems from the particular way Microsoft has configured its authentication service, which only uses the username to differentiate accounts, unlike Google and similar competing systems which also add the name of the issuer to the account.
This is by no means a new problem. Users have been complaining about the issue in Microsoft support channels as far back as 2020, and it looks like the issue has been persistent since the authenticator was released in 2016.
Last week, Brett Randall, founder and principal consultant at Fractl, took to LinkedIn to complain about the issue, shedding light on the issue once more.
Randall said he dug into the issue after observing the authenticator overwriting another application’s TOTP key when using the QR code to scan for MFA in a training session with a vendor.
But after reporting the issue to Microsoft, Randall reported being told the bug was ‘by design’, stating that trying to get the company to recognize the problem and do something about it has been “nigh on impossible”.
“Watching a room full of people lose access to other systems as they gradually scanned a QR code and Microsoft Authenticator overwrote their keys to other systems was painful.”
This creates further confusion as organizations often misattribute who is responsible for the problem, and get in touch with the company issuing the authentication, wasting hours with their helpdesk trying to fix an issue that has nothing to do with the firm.
Microsoft Authenticator issue can be fixed
There are workarounds available, however, as one user posting on Microsoft Learn noted in 2022. The workaround involves manually entering the secret key from the identity provider into the Authenticator app during setup.
But they noted this is not a particularly practical fix when it comes to large enterprises.
“Unfortunately, this is not very helpful in an enterprise environment, especially when the average end user rarely knows anything about the inner workings of Authentication, and seeing a random string of characters is intimidating.”
As multi factor authentication (MFA) becomes the default protection layer on most user accounts, there is increasing reliance on these systems for access to digital systems.
RELATED WHITEPAPER
As such, these tools need to be as robust as possible, or risk locking millions of users out of their accounts.
Glenn Chishold, chief product officer at Obsidian, said that because the majority of organizations recognize the importance of using MFA to secure their accounts, vendors need to ensure their solutions are reliable enough to withstand increased pressure on them.
"We know that MFA is crucial in protecting against basic forms of compromise. Even so, we see major breaches using accounts that only have basic authentication enabled (like the breach that affected AT&T's Snowflake instance),” he explained.
“With the vast majority of users choosing to use their mobile device for MFA, it's beholden on vendors to ensure that these technologies are easy to adopt and difficult to circumvent.”
Chisholm added that security professionals should be wary that as users flood IT support channels trying to troubleshoot the issue, they are prime targets for social engineering attacks looking to gain a foothold on the network.
"Unfortunately in this instance, the ‘expected behavior’ of the Microsoft authenticator app can cause overwrites of existing accounts. That might mean that enterprises need to help their users re-establish access to their accounts,” he said.
“Security teams need to be aware that this might also provide an opportunity for attackers to socially engineer helpdesk users, convincing them to grant unauthorized access to users accounts, as we saw in the well-documented MGM breach."
-
Should AI PCs be part of your next hardware refresh?AI PCs are fast becoming a business staple and a surefire way to future-proof your business
-
Westcon-Comstor and Vectra AI launch brace of new channel initiativesNews Westcon-Comstor and Vectra AI have announced the launch of two new channel growth initiatives focused on the managed security service provider (MSSP) space and AWS Marketplace.
-
So long, Defender VPN: Microsoft is scrapping the free-to-use privacy tool over low uptakeNews Defender VPN, Microsoft's free virtual private network, is set for the scrapheap, so you might want to think about alternative services.
-
Hackers are on a huge Microsoft 365 password spraying spree – here’s what you need to knowNews A botnet made up of 130,000 compromised devices has been conducting a huge password spraying campaign targeting Microsoft 365 accounts.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Microsoft is increasing payouts for its Copilot bug bounty programNews Microsoft has expanded the bug bounty program for its Copilot lineup, boosting payouts and adding coverage of WhatsApp and Telegram tools.
-
Hackers are using this new phishing technique to bypass MFANews Microsoft has warned that a threat group known as Storm-2372 has altered its tactics using a specific ‘device code phishing’ technique to bypass MFA and steal access tokens.
-
A new phishing campaign is exploiting Microsoft’s legacy ADFS identity solution to steal credentials and bypass MFANews Researchers at Abnormal Security have warned of a new phishing campaign targeting Microsoft's Active Directory Federation Services (ADFS) secure access system.
-
Hackers are using Microsoft Teams to conduct “email bombing” attacksNews Experts told ITPro that tactics like this are on the rise, and employees must be trained effectively
-
Microsoft files suit against threat actors abusing AI services
News Cyber criminals are accused of using stolen credentials for an illegal hacking as a service operation
