Wrong information about MFA and security on Azure Fundamentals course

Pasi Alho 0 Reputation points
2023-01-12T08:29:23.1533333+00:00

On Azure Fundamentals training module:
[https://video2.skills-academy.com/en-us/training/modules/describe-azure-identity-access-security/3-authentication-methods
It states about MFA:
"With multifactor authentication enabled, an attacker who has a user's password would also need to have possession of their phone or their fingerprint to fully authenticate."
This is not totally true.
Attackers can build websites, that work as proxy and can disguise as legitimate MFA authentication pages. When user is authenticating (received phishing mail that directed user to this page), these websites can fool the user to enter their MFA code on the page, stealing and proxying it to the real Microsoft Login. This way, the attacker does not need to have possession of the phone or fingerprint to fully authenticate.

Can you fix or rephrase this information on the module?

Azure Training
Azure Training
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.Training: Instruction to develop new skills.
1,244 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. kobulloc-MSFT 25,961 Reputation points Microsoft Employee
    2023-01-12T20:58:39.0033333+00:00

    Hello!

    Where am I seeing this?

    Multifactor authentication is not completely immune to attack

    This is certainly true. Security is a scale on which you can achieve high degrees of security but it's very difficult to say that anything is completely immune to an attack. We've definitely seen some impressive examples of this in headlines over the past several years.

    An adversary-in-the-middle (also known as MITM) attack could effectively capture the form (or factor) of identification that is provided by something that the user has. Fortunately, this is time sensitive and orders of magnitude more difficult than methods used to bypass something that the user knows, which makes this type of attack less common than those made on password checks.

    We'll pass this suggestion along to the content team however there was recently a major effort to make the Azure Fundamentals content less technical in order to focus on concepts. As a result, a change may complicate the training material too much for an introductory course at this time.

    Thank you very much for your feedback!

    0 comments