Lapsus$ - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/actors/lapsus/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Okta Multiple Failed MFA Requests Indicate Potential MFA Bypass Attempthttps://feed.craftedsignal.io/briefs/2024-01-okta-mfa-bypass/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-okta-mfa-bypass/An adversary may attempt to bypass MFA by bombarding a user with repeated authentication requests, potentially leading to unauthorized access and system compromise.This brief addresses the threat of adversaries attempting to bypass multi-factor authentication (MFA) in Okta environments. Attackers, such as the Lapsus$ group and APT29, may employ techniques involving repeated MFA requests to overwhelm a user, hoping they will eventually approve a request either accidentally or out of frustration. This analytic focuses on identifying anomalous activity characterized by a high number of failed MFA attempts for a single user within a short timeframe. Specifically, the detection triggers when more than 10 failed MFA attempts are observed within a 5-minute window, based on Okta event logs. A successful MFA bypass can grant unauthorized access to sensitive resources, potentially leading to data breaches and further compromise.

Attack Chain

  1. The attacker obtains valid credentials for an Okta user, potentially through phishing or credential stuffing.
  2. The attacker attempts to authenticate to Okta using the compromised credentials.
  3. Okta prompts the user for MFA.
  4. The attacker initiates a rapid series of authentication attempts, triggering multiple MFA requests to the user's device.
  5. The user experiences a barrage of MFA push notifications or phone calls.
  6. The attacker hopes the user approves one of the MFA requests either accidentally or due to fatigue.
  7. If the user approves an MFA request, the attacker gains access to the Okta account.
  8. The attacker leverages the compromised Okta account to access applications and resources protected by Okta, potentially leading to data exfiltration or other malicious activities.

Impact

A successful MFA bypass can lead to unauthorized access to critical systems and data. This can result in data breaches, financial losses, and reputational damage. The Okta Account Takeover analytic story highlights the potential impact. Given that Okta is often used as a central identity provider, a compromise can have wide-ranging consequences across an organization's entire infrastructure. Identifying and mitigating these attacks is crucial to maintaining a strong security posture.

Recommendation

  • Deploy the provided Sigma rules to your SIEM to detect suspicious patterns of failed MFA requests in Okta logs.
  • Investigate any alerts generated by these rules, paying close attention to the source IP addresses (src_ip) associated with the failed attempts.
  • Implement user training to educate employees about the risks of MFA fatigue and how to recognize and report suspicious MFA requests.
  • Configure Okta to limit the number of MFA requests that can be initiated within a specific timeframe to mitigate MFA fatigue attacks.
  • Use Okta Risk Engine to detect and block suspicious login attempts based on factors such as location, device, and behavior.
  • Review Okta event logs for user.authentication.auth_via_mfa events with outcome.result=FAILURE to identify potential MFA bypass attempts.
]]>highthreatoktamfacredential-accessmfa-bypass