Cybersecurity

6136 readers

64 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Be respectful. Everyone should feel welcome here.
No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
No Ads / Spamming.
No pornography.

Community Rules

Idk, keep it semi-professional?
Nothing illegal. We're all ethical here.
Rules will be added/redefined as necessary.

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

founded 2 years ago

MODERATORS

[email protected]

Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (www.bleepingcomputer.com)

submitted 3 weeks ago by [email protected] to c/[email protected]

3 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] towerful 5 points 3 weeks ago

The researchers say that 41.5% of the attacks fail, 21% lead to account lockouts imposed by protection mechanisms, 17.7% are rejected due to access policy violations (geographic or device compliance), and 10% were protected by MFA.

This leaves 9.7% of cases where the threat actors successfully authenticate to the target account, a notably high success rate.

This actually has nothing to do with the fastHTTP library, other than it happens to be the library they use.

Sounds like a classic brute force attempt, which happened to have a 9.7% success rate.
Whether this is bad config on behalf of the user, or bad config on behalf of Azure isn't really clear.
Regardless, the fault is with Azure for not mitigating this and providing a secure-by-default service.
I can't believe 10% of users deliberately weakened their security settings.

The article does mention MFA fatigue. I guess where so many "type in the code"/"is this you" type prompts resulted in the user just accepting (or worse, accepting by force of habit) to get rid of them.
Unexpected MFA and security alerts should be investigated immediately.