BEC Phishing Campaigns Bypass MFA, Target Office 365 Executive Accounts

Attacks Bypassing MFA, Conditional Access 

Meanwhile, a report from Abnormal Security detailed an uptick in overall BEC campaigns, which are credited to hackers successfully bypassing conditional access controls and multi-factor authentication. Notably, previous Microsoft research showed MFA blocks 99.9 percent of automated attacks. 

Researchers noted that many enterprises believe MFA provides full protection from account takeovers, But in reality, following this mindset makes the organization vulnerable to “these rare but costly events.” 

The report found a common pattern in the recent surge of these attacks: The hacker immediately switches to a legacy application after they are blocked by MFA. Most credential stuffing campaigns leverage legacy applications like IMAP4 to ensure MFA does not hinder the attacks. 

Further, even when conditional access policies in place to block all legacy app access, researchers still found hackers are successfully taking over accounts: simply bypassing the policy by obscuring the name of the app used. 

For example, one instance saw an attacker initially attempt to sign-in with a legacy application that was blocked by conditional access. The hacker waited a few days and attempted again, by obscuring the app information to successfully gain access to the account. 

“This example demonstrates that while most account takeover attempts utilize brute-force attacks and password spraying techniques, some attackers are methodical and deliberate,” researchers wrote. “These attackers are able to gain access to accounts even with the most secure protocols in place.”  

Researchers stressed that while MFA and other authentication protocols provide advanced access security, many common – and often legacy – applications don’t support modern authentications. Those apps include iOS mail for iOS 10 and older. 

“Legacy email protocols, including IMAP, SMTP, MAPI and POP, do not support MFA, making it possible for attackers to easily bypass MFA using these legacy applications,” researchers explained. “This means that it is not possible to enforce MFA when a user signs into their account using one of these applications.” 

And while many Office 365 licenses are able to configure conditional access policies – a way to increase security by barring access from legacy applications (often targeted in password-spraying campaigns), researchers stressed these tools have some weaknesses and drawbacks. 

Namely, conditional access isn’t included with all licenses, meaning some enterprises are unable to protect against these types of attacks. And legacy applications are widespread in most enterprises, especially in the healthcare sector. 

Legacy access is enabled by default in O365 and completely barring legitimate access using these applications is disruptive to the workforce. Even if an enterprise has employed conditional access to block legacy apps, researchers found hackers are still able to access accounts by obscuring the app used in the attacks. 

“To avoid this, Microsoft recommends first examining the sign-in logs to determine which users are not using legacy applications and applying the Conditional Access policy to them only,” researches explained. “Of course, this leaves those who do use these applications vulnerable.” 

“Attempting to apply legacy blocking based on the platform creates another known vulnerability: the platform is determined by Microsoft based on the user agent, which is very easy to falsify,” they added. “Attackers simply have to cycle through user agents until they find one with more lax access policies that are easier to bypass.” 

Defense and Mitigation 

Previous Barracuda Networks research found BEC attacks account for just 7 percent of spear-phishing attacks. However, researchers warned that the targeted nature of these phishing emails make these attack three times more effective than traditional phishing schemes. Much of that success is attributed to the highly targeted nature of these attacks. 

In light of the potential impact, Trend Micro shared indicators of compromise (IoCs), threat actor managed URLs, and MITRE Attack matrix mapping, as well as a host of recommendations for defense and mitigation tactics. 

Administrators must educate and train employees, including C-suite executives. Training should cover the different types of scams and how to respond to expected encounters, including double-checking with other team members and verifying the email details. 

Financial requests should be confirmed through other channels following a verification system that includes multiple signoffs or other verification protocols, especially for employees working with sensitive or valuable information. 

All emails should be scrutinized for suspicious content, such as a dubious sender email, domain name, formatting, urgent requests, and even writing style. 

“In the case discussed here, the attacker email itself does not include the typical malware payload of malicious attachments,” researchers wrote. “As a result, traditional security solutions won’t be able to protect accounts and systems from such attacks. Users can also turn on mail inspection for sender 'sendgrid[.]net' in the email gateway.”