A newly discovered vulnerability in Microsoft Corp.’s Activity Directory Federation Services allows hackers to bypass multifactor authentication safeguards in a potentially serious threat to a standard that has been pushed as a way to improve security.

Discovered by Okta Inc. Security Engineer Andrew Lee, the vulnerability revealed today does require a wannabe hacker to have full access to another user’s credentials on the same ADFS service. But in this case, if a single user’s password and second factor are compromised, that second factor can be used in place of anyone else’s in the organization.

The method is described as similar to taking a room key for a building and turning it into a skeleton key that works on every door in the building, but in this building each door requires two keys to open. The vulnerability, CVE-2018-8340, allows a hacker to intercept the keys in transmission.

“This vulnerability is due to a failure to cryptographically enforce the integrity and authenticity of relationships between the two pieces of identity — the primary credentials and the second factor,” Lee explained. “Although Microsoft cryptographically signs the MFA Context before passing it to the user, then checks the signature when the user sends it back, this only enforces its internal integrity and authenticity.”

The good news is that prior to the revelation of the vulnerability Microsoft has issued a patch but those who are not up to date with patching remain at risk.

“With the understanding of how most credential phishing attacks work nowadays, this exploit gives an actor an incredible advantage to expand compromises significantly,” a spokesperson for Okta explained to SiliconANGLE. “Corporations rely on MFA to limit credential attacks, which might lead them to be susceptible to back-of-mind threats such as insider intrusions.”

In other words, the spokesperson added, “if just one employee in a massive, global company wanted to – or if a bad actor compromised the account of one employee – they could do a lot of harm by compromising unsuspecting colleagues, senior executives or even the CEO.”

Image: Maxpixel