#RateLimiting

Researchers Crack Microsoft Azure MFA in an Hour

by

December 11, 2024 at 03:50PM Researchers at Oasis Security exploited a Microsoft Azure multifactor authentication vulnerability, dubbed “AuthQuake,” allowing unauthorized access to user accounts, including Microsoft 365 services. The flaw, caused by a lack of rate limits during MFA sign-in attempts, was fixed by Microsoft in October 2023. Recommendations for improved security were provided. ### … Read more

Microsoft MFA AuthQuake Flaw Enabled Unlimited Brute-Force Attempts Without Alerts

by

December 11, 2024 at 09:42AM A critical vulnerability in Microsoft’s multi-factor authentication (MFA) was identified, allowing attackers to bypass security easily without user notice. Labeled AuthQuake, the flaw stemmed from inadequate rate limits and extended code validity. Microsoft addressed the issue in October 2024, tightening security measures to enhance MFA effectiveness. **Meeting Takeaways: Dec 11, … Read more