Researchers Crack Microsoft Azure MFA in an Hour

Share:

A critical flaw in the company’s rate limit for failed sign-in attempts allowed unauthorized access to a user account, including Outlook emails, OneDrive files, Teams chats, Azure Cloud, and more.

Researchers cracked a Microsoft Azure method for multifactor authentication (MFA) in about an hour, due to a critical vulnerability that allowed them unauthorized access to a user’s account, including Outlook emails, OneDrive files, Teams chats, Azure Cloud, and more.

Researchers at Oasis Security discovered the flaw, which was present due to a lack of rate limit for the amount of times someone could attempt to sign in with MFA and fail when trying to access an account, they revealed in a blog post on Dec. 11. The flaw exposed the more than 400 million paid Microsoft 365 seats to potential account takeover, they said.

When signing into a Microsoft account, a user supplies their email and password and then selects a pre-configured MFA method. In the case used by the researchers, they are given a code by Microsoft via another form of communication to facilitate sign-in.

The researchers achieved the bypass, which they dubbed “AuthQuake,” by “rapidly creating new sessions and enumerating codes,” Tal Hason, an Oasis research engineer, wrote in the post. This allowed them to demonstrate “a very high rate of attempts that would quickly exhaust the total number of options for a 6-digit code,” which is 1 million, he explained.

“Simply put — one could execute many attempts simultaneously,” Hason wrote. Moreover, during the multiple failed attempts to sign in, account owners did not receive any alert about the activity, “making this vulnerability and attack technique dangerously low profile,” Hason wrote.

Oasis informed Microsoft of the issue, which acknowledged its existence in June and fixed it permanently by Oct. 9, the researchers said. “While specific details of the changes are confidential, we can confirm that Microsoft introduced a much stricter rate limit that kicks in after a number of failed attempts; the strict limit lasts around half a day,” Hason wrote.

Elizabeth Montalbano

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
3:04 am, Apr 4, 2025
weather icon 10°C
L: 8° | H: 11°
overcast clouds
Humidity: 82 %
Pressure: 1019 mb
Wind: 3 mph ENE
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 100%
Rain Chance: 0%
Visibility: 8 km
Sunrise: 6:28 am
Sunset: 7:37 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
8° | 11°°C 0 mm 0% 13 mph 83 % 1020 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
7° | 17°°C 0 mm 0% 13 mph 72 % 1021 mb 0 mm/h
Sun Apr 06 10:00 pm
weather icon
7° | 13°°C 0 mm 0% 13 mph 78 % 1027 mb 0 mm/h
Mon Apr 07 10:00 pm
weather icon
5° | 14°°C 0 mm 0% 8 mph 77 % 1029 mb 0 mm/h
Tue Apr 08 10:00 pm
weather icon
5° | 14°°C 0 mm 0% 8 mph 73 % 1030 mb 0 mm/h
Today 4:00 am
weather icon
10° | 11°°C 0 mm 0% 4 mph 82 % 1019 mb 0 mm/h
Today 7:00 am
weather icon
10° | 10°°C 0 mm 0% 5 mph 83 % 1019 mb 0 mm/h
Today 10:00 am
weather icon
14° | 17°°C 0 mm 0% 9 mph 68 % 1020 mb 0 mm/h
Today 1:00 pm
weather icon
20° | 20°°C 0 mm 0% 11 mph 46 % 1019 mb 0 mm/h
Today 4:00 pm
weather icon
19° | 19°°C 0 mm 0% 13 mph 40 % 1018 mb 0 mm/h
Today 7:00 pm
weather icon
15° | 15°°C 0 mm 0% 10 mph 57 % 1018 mb 0 mm/h
Today 10:00 pm
weather icon
12° | 12°°C 0 mm 0% 10 mph 66 % 1019 mb 0 mm/h
Tomorrow 1:00 am
weather icon
9° | 9°°C 0 mm 0% 10 mph 65 % 1019 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€74,674.95
-1.43%
Ethereum(ETH)
€1,627.76
-1.50%
Tether(USDT)
€0.90
-0.02%
XRP(XRP)
€1.84
-0.85%
USDC(USDC)
€0.90
-0.01%
Solana(SOL)
€103.83
-4.10%
Dogecoin(DOGE)
€0.144972
-3.48%
Shiba Inu(SHIB)
€0.000011
-2.05%
Pepe(PEPE)
€0.000006
-7.11%
Scroll to Top