Researchers Crack Microsoft Azure MFA in an Hour

Share:

A critical flaw in the company’s rate limit for failed sign-in attempts allowed unauthorized access to a user account, including Outlook emails, OneDrive files, Teams chats, Azure Cloud, and more.

Researchers cracked a Microsoft Azure method for multifactor authentication (MFA) in about an hour, due to a critical vulnerability that allowed them unauthorized access to a user’s account, including Outlook emails, OneDrive files, Teams chats, Azure Cloud, and more.

Researchers at Oasis Security discovered the flaw, which was present due to a lack of rate limit for the amount of times someone could attempt to sign in with MFA and fail when trying to access an account, they revealed in a blog post on Dec. 11. The flaw exposed the more than 400 million paid Microsoft 365 seats to potential account takeover, they said.

When signing into a Microsoft account, a user supplies their email and password and then selects a pre-configured MFA method. In the case used by the researchers, they are given a code by Microsoft via another form of communication to facilitate sign-in.

The researchers achieved the bypass, which they dubbed “AuthQuake,” by “rapidly creating new sessions and enumerating codes,” Tal Hason, an Oasis research engineer, wrote in the post. This allowed them to demonstrate “a very high rate of attempts that would quickly exhaust the total number of options for a 6-digit code,” which is 1 million, he explained.

“Simply put — one could execute many attempts simultaneously,” Hason wrote. Moreover, during the multiple failed attempts to sign in, account owners did not receive any alert about the activity, “making this vulnerability and attack technique dangerously low profile,” Hason wrote.

Oasis informed Microsoft of the issue, which acknowledged its existence in June and fixed it permanently by Oct. 9, the researchers said. “While specific details of the changes are confidential, we can confirm that Microsoft introduced a much stricter rate limit that kicks in after a number of failed attempts; the strict limit lasts around half a day,” Hason wrote.

Elizabeth Montalbano

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
5:46 am, Apr 2, 2025
weather icon 7°C
L: 5° | H: 8°
clear sky
Humidity: 82 %
Pressure: 1023 mb
Wind: 6 mph NE
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 0%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 6:33 am
Sunset: 7:34 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
5° | 8°°C 0 mm 0% 15 mph 82 % 1023 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
9° | 16°°C 0 mm 0% 11 mph 85 % 1022 mb 0 mm/h
Fri Apr 04 10:00 pm
weather icon
10° | 18°°C 0 mm 0% 14 mph 85 % 1022 mb 0 mm/h
Sat Apr 05 10:00 pm
weather icon
7° | 17°°C 0 mm 0% 12 mph 76 % 1022 mb 0 mm/h
Sun Apr 06 10:00 pm
weather icon
7° | 14°°C 0 mm 0% 11 mph 76 % 1025 mb 0 mm/h
Today 7:00 am
weather icon
7° | 7°°C 0 mm 0% 10 mph 82 % 1023 mb 0 mm/h
Today 10:00 am
weather icon
8° | 12°°C 0 mm 0% 14 mph 76 % 1023 mb 0 mm/h
Today 1:00 pm
weather icon
12° | 15°°C 0 mm 0% 15 mph 60 % 1022 mb 0 mm/h
Today 4:00 pm
weather icon
15° | 15°°C 0 mm 0% 15 mph 56 % 1021 mb 0 mm/h
Today 7:00 pm
weather icon
13° | 13°°C 0 mm 0% 12 mph 61 % 1021 mb 0 mm/h
Today 10:00 pm
weather icon
10° | 10°°C 0 mm 0% 10 mph 69 % 1021 mb 0 mm/h
Tomorrow 1:00 am
weather icon
10° | 10°°C 0 mm 0% 10 mph 76 % 1021 mb 0 mm/h
Tomorrow 4:00 am
weather icon
9° | 9°°C 0 mm 0% 9 mph 80 % 1020 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€78,226.51
1.59%
Ethereum(ETH)
€1,739.47
2.15%
Tether(USDT)
€0.93
0.01%
XRP(XRP)
€1.94
-0.36%
Solana(SOL)
€115.29
-1.27%
USDC(USDC)
€0.93
0.00%
Dogecoin(DOGE)
€0.158558
1.44%
Shiba Inu(SHIB)
€0.000011
-2.88%
Pepe(PEPE)
€0.000007
2.95%
Scroll to Top