PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

MFA security part 2: How to prevent MFA bypass

bugcrowd.com | blog | #phishing | #red-team | #authentication | #mfa | #aitm | #fido2 | #conditional-access
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bugcrowd's MFA blog explains why adversary-in-the-middle attacks are growing and outlines defenses: phishing-resistant FIDO2 authentication, stronger conditional access policies, dropping SMS MFA.
Published
Collected

Related coverage

blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Multi-Factor Authentication: The Bare Minimum of IAM
Sectigo CTO Jason Soroko joins the Agent of Influence podcast to explain why MFA is the bare minimum of IAM, covering symmetric vs. asymmetric secrets and digital certificate best practices.
blog · bugcrowd.com
MFA security part 1: How attackers bypass multi-factor authentication
Bugcrowd's red team series details five MFA bypass approaches: conditional access gaps, machine-based attacks, phishing, phone attacks, and insider threats, with growing focus on AiTM techniques.
blog · blog.trailofbits.com
SAML: A fractal of bad design
Trail of Bits traces SAML's committee-driven origins and argues the 2002 XML-based SSO protocol should finally be retired: cursed XML signature validation keeps producing vulnerabilities, and OIDC is the way forward.
blog · bishopfox.com
What the Newly Drafted NIST Password Guidelines Mean to You
NIST's newly drafted digital identity guidelines analyzed: passwords checked against breach lists, dictionary words and context terms; SMS dropped as a single factor as push-based MFA gains ground.
blog · bishopfox.com
Stand Your Cloud: A Series on Securing AWS
First in Bishop Fox's AWS security series: harden IAM with least-privilege policies, 90-day key rotation, MFA on all accounts including root, and use security groups as virtual firewalls.
Back