SolarWinds hackers have a clever way to bypass multi factor authentication

Hackers who hit SolarWinds compromised a think tank three separate times.

Read the whole story

 

[Aguyd]

Novel indeed.

These cookies are used for "Trust This Device"-type settings right, given that they had to present the username and password? If the user/organisation required a new MFA confirmation for every login would that "overcome" this particular problem?

I mean, Dark Halo still gained admin access to the network, so there's a few other problems there.

Also, I despise the Outlook Web App.

If you configured your server to require new MFA confirmation for every login, the hackers could just turn that setting off. Or do something else. Fundamentally, MFA is intended as a mitigation for client compromise (e.g., due to phishing, password reuse, etc.) . MFA does not protect against server compromise.