Episode 37: How legacy authentication lets attackers bypass MFA

Adam

Imagine for a second that you just bought a uh a brand new house.

Christina

Okay, nice.

Adam

Right. And you go out and you install the most expensive state-of-the-art deadbolt on your front door.

Christina

Oh, yeah, like a heavy-duty smart lock.

Adam

Exactly. The kind that needs a fingerprint, maybe an encrypted passcode, and you feel incredibly secure. But uh without realizing it, you left a side window wide open.

Christina

Oh no.

Adam

Yeah. And you left it open for four straight years.

Christina

Wow. Four years.

Adam

Four years. And that scenario is essentially what happened to the company in today's source material. They suffered a credential stuffing attack that completely compromised 12 different accounts inside a single client environment.

Christina

12 accounts. That's I mean, that's significant.

Adam

It's massive. So our mission for this deep dive is to really deconstruct exactly how attackers are bypassing modern security with these, you know, incredibly cheap, low-tech tools.

Christina

And crucially, to extract the actionable preventative measures you can apply to your own organization or your clients.

Adam

Right, exactly. Okay, let's unpack this timeline because the way this breach unfolded just totally shatters a lot of assumptions about cybersecurity.

Christina

It really does. I mean, to me, the scariest part of this entire breach isn't some highly sophisticated zero-day exploit.

Adam

Like some nation state developed in a secret lab.

Christina

Right, exactly. It's not that at all. It is how utterly routine and honestly lazy the whole attack was.

Adam

Yeah.

Christina

There is no evil genius at a keyboard here. It's just a script running quietly in the background while the attacker is, I don't know, probably off eating lunch.

Adam

Which is so crazy because I think we all have this Hollywood stereotype stuck in our heads, right?

Christina

Oh, the guy in the dark hoodie.

Adam

Exactly. The guy furiously typing green code onto a black screen, actively fighting against a firewall in real time.

Christina

Sweating as the timer runs down.

Adam

Sweating, yeah. Trying to break in. But looking at these documents, that is completely divorced from reality. I was thinking about it like this isn't a master jewel thief picking a high-tech vault. This is someone buying a cheap keychain of like 340 discarded keys at a yard sale.

Christina

Oh, that's a great analogy.

Adam

And they're just casually walking down your street, trying them on every single door in the neighborhood just to see what opens.

Christina

That is the perfect analogy. And let's actually look at the preparation stage of this attack because they didn't steal the passwords themselves. Right. They simply went onto a dark web marketplace and bought a database from an entirely different data breach, one that happened way back in 2021.

Adam

Wow. Just bought it off the shelf.

Christina

Yeah, it's a routine, everyday transaction. And according to the source, acquiring this massive list of exposed credentials costs them less than you probably pay for, like a monthly streaming subscription.

Adam

That's terrifying. So they buy this cheap list and then they cross-reference email domains to find known business targets.

Christina

Exactly.

Adam

And for this specific client, they found 340 email and password pairs matching the target's corporate domain.

Christina

340 keys on that keychain.

Adam

Right. And this is where the automation you mentioned comes in. I mean, they certainly didn't sit there and type these in manually one by one.

Christina

No, no, they used automated distributed proxies. They just pointed these proxies at the Microsoft 365 login endpoints and ran those 340 credentials.

Adam

Wait, let me stop you there for a second. When you say automated distributed proxies, what does the Microsoft server actually see?

Christina

That's a good question.

Adam

Because does it just see one IP address hammering the front door? Wouldn't that get blocked instantly?

Christina

It would get blocked instantly. Which is exactly why they use distributed proxies. Instead of the attack coming from one single server in, say, Russia or China, the attacker routes their login attempts through hundreds of different perfectly normal looking IP addresses.

Adam

Oh wow. Like what kind of addresses?

Christina

Often compromised residential routers or uh IoT devices, smart fridges, things like that.

Adam

You're kidding.

Christina

No. So to Microsoft, it just looks like John from accounting is logging in from his home Wi-Fi in Ohio, and Sarah from HR is logging in from a coffee shop in Texas.

Adam

That is so sneaky.

Christina

And here is the truly critical detail. They deliberately throttled their attempts. They only tried two passwords per account per hour.

Adam

Two per hour, which I mean, that completely bypasses the standard alarms, right? Exactly. Because if you hammer a server with a hundred password attempts in a minute, the system locks the account and flags the security team. But two attempts an hour, that just looks like an employee who forgot their password, tried twice and went to get a coffee.

Christina

Precisely. They stayed well below the standard lockout thresholds. It's what we call a low and slow approach. Right. And out of 340 attempts, they got 12 successful authentications. That is a 3.5% success rate.

Adam

Which, you know, it sounds tiny until you realize that having 12 compromised accounts inside a single client environment is an absolute catastrophe.

Christina

Complete catastrophe.

Adam

But here is the question that jumps out at me. This attack happened four years after the passwords were leaked in 2021.

Christina

Yeah.

Adam

Why on earth would those passwords still work four years later? Haven't people changed them?

Christina

Well, you're touching on a fundamental flaw in human psychology there.

Adam

Yeah.

Christina

Password reuse is human nature.

Adam

Yeah, I guess that's true.

Christina

If nobody actively forces an employee to change their password, they are going to use the exact same one they use for their personal fitness app or, you know, their dog walking service.

Adam

Or their meal delivery app.

Christina

Exactly. Which means a breach in a totally unrelated, low security platform lands squarely inside your highly secure corporate environment years later.

Adam

It's the ultimate back door. But okay, I'm looking at the source here and I'm a little confused.

Christina

Okay.

Adam

Because getting the password right is only step one. Here's where it gets really interesting. Yeah. The source material states that three of those 12 compromised accounts actually had multi-factor authentication MFA turned on.

Christina

They did.

Adam

I thought MFA was the silver bullet. If the front door has that smart lock we talked about, how did they bypass the MFA without intercepting a text message or doing a sim swap or tricking someone into giving them a code?

Christina

Well, what's fascinating here is they didn't have to hack the MFA at all. They didn't break the smart lock.

Adam

They didn't.

Christina

No, they bypassed it entirely by exploiting something called legacy authentication protocols.

Adam

Legacy protocols. Like what specifically and why are they even still around?

Christina

So we're talking about older email protocols like basic authentication, SMTPA8, IMAP, POP3.

Adam

Oh wow. Blast from the past.

Christina

Right. These were built decades ago, long before modern multi-factor authentication even existed. I mean, think about how email used to work in the late 90s.

Adam

Just typing in a username and password.

Christina

Exactly. Your email software just sent your credentials over the internet in clear text. There was no pop-up browser window to render an interactive Microsoft login page that could ask for a fingerprint.

Adam

Okay, but if the company pays for Microsoft 365 and they explicitly turn on MFA for their employees, shouldn't Microsoft servers just physically reject any login attempt that doesn't support MFA?

Christina

You would think so.

Adam

Why does a legacy protocol even get to the password checking phase?

Christina

It comes down to backward compatibility. For a very long time, Microsoft left these legacy protocols enabled by default.

Adam

Because of old hardware? Yes.

Christina

Because companies had old hardware fax machines, old scanners, custom-built legacy software that physically couldn't process an MFA prompt.

Adam

Oh, I see.

Christina

And the Microsoft 365 tenant in this specific case still had these legacy protocols enabled. So because these old protocols structurally do not know how to ask for an MFA code, they just ask for the password.

Adam

That is mind-blowing. So if an attacker points their automated script at the ancient IMAP protocol instead of the modern web login page, the system just checks the password and says, Yep, that matches. Come on in. Yep. And it completely ignores the fact that the company mandated MFA for that user.

Christina

Exactly. It just lets them walk right around it. If legacy authentication is left enabled on a tenant, your MFA is nothing more than an illusion of security.

Adam

Wow.

Christina

You spent thousands of dollars on the deadbolt, but the attacker just slid the old rusted side window open.

Adam

That really shifts the entire perspective from, you know, how did they break our advanced security to why did we leave the ancient back door propped open?

Christina

Precisely.

Adam

Okay, so they've exploited the legacy back door to get in, but getting in is only half the battle. If that compromised employee changes their password tomorrow, the attacker is locked out again. Right. How do they guarantee they keep that access? Because according to the source, this wasn't just a smash and grab. This was an 11-day silent squatter.

Christina

Yeah, 11 days. Once they had access to those 12 accounts, they assessed their options and chose the office manager's account to be their primary base of operations.

Adam

Makes sense. Office managers have access to everything.

Christina

Exactly. And the office manager had no MFA enforced and was accessible via that legacy protocol. So once inside, the attacker didn't just look at emails.

Adam

What did they do?

Christina

They went straight for the file storage SharePoint, OneDrive, shared mailboxes. They started quietly downloading client contracts, financial documents, highly sensitive HR files.

Adam

But they didn't stop at data exfiltration. They set up shop to ensure they wouldn't lose access.

Christina

Right. What the source calls stage four persistence.

Adam

Yeah. First, they created an inbox rule on the office manager's account to forward all incoming emails to an external address controlled by the attacker. But why an inbox rule? Why not just log in every day to check the mail?

Christina

Because logging in creates logs. Every time an attacker authenticates, there is a risk of triggering a security alert, like an impossible travel flag.

Adam

Oh, so they wanted to be invisible.

Christina

Exactly. By setting up an inbox rule, the attack becomes entirely passive. The office manager goes about their day receiving emails, but a blind copy of every single message is silently routed to the attacker's server.

Adam

That is so creepy.

Christina

And even if the office manager realizes something is weird and changes their password, the attacker doesn't care. They're still receiving a copy of the mail.

Adam

And then they went a step further. They registered a brand new secondary MFA device to the compromised account.

Christina

Which is basically how you change the locks on the house you just broke into. Right. By registering their own smartphone or authenticator app, they locked in their access. If the IT department suddenly woke up the next day and decided to enforce MFA across the entire company, the attacker wouldn't be locked out.

Adam

Because they already have an approved device.

Christina

Exactly. They have their own set of keys now.

Adam

So they forwarded your mail, they changed the locks by adding their own device, and then they did something that I find truly terrifying.

Christina

The mail flow rule.

Adam

Yeah. They reprogrammed the company's digital mail sorting machine. The source says they created a mail flow rule specifically designed to silently delete any incoming security alert email. Yes. If Microsoft's automated systems detected the new device and sent a warning email saying, uh, alert, a new MFA device has been registered, that mailflow rule would instantly catch it.

Christina

And just trash it. The sorting machine quietly shreds the alert before the office manager's inbox even knows it exists. It is total invisibility.

Adam

Wow.

Christina

They sat there in the dark for 11 days monitoring email conversations, specifically waiting for invoice and payment discussions.

Adam

So they could intercept a communication and redirect a massive payment to their own offshore bank account.

Christina

Exactly.

Adam

Eleven days of total access to the entire company's inner workings.

Christina

So what finally tripped them up? I mean, how were they caught before the money actually moved?

Adam

Well, it came down to a single alert. And a human being actually paying attention to a dashboard, a SOC analyst, a security operations center analyst, was reviewing logs and noticed an impossible travel flag at 3.00 AM.

Christina

Let's break that down for a second. How does the impossible travel alert actually work, technically?

Adam

The system looks at the geography and the physics of the logins. If the office manager logs into their email from their phone in New York at 2.30 a.m., and then another login attempt for that exact same account happens from an IP address in Eastern Europe at 3.0 a.m. The system flags it. Because it's physically impossible for the user to have traveled across the Atlantic Ocean in 30 minutes.

Christina

Correct. The geography was totally inconsistent with the employee's normal pattern. Right. And because that specific SOC analyst actually investigated that single 3.0 AM alert, rather than just dismissing it as a glitch, they pulled the thread that unraveled the entire operation.

Adam

Wow.

Christina

They dug into the logs, found the hidden inbox forwarding rule, found the rogue MFA device, and eventually saw the full, horrifying scope of the downloaded HR and financial files.

Adam

But if that one alone had been ignored, the attacker would have stayed indefinitely.

Christina

Indefinitely.

Adam

Man. Having seen the absolute devastation that such a simple routine attack can cause, we really need to pivot to the solutions. Absolutely. Because we can't just send out a company memo saying, please stop reusing your dog's name for your password and just hope the problem goes away. We need a structural technical safety net.

Christina

Yes, we do.

Adam

And the source material lays out an arsenal of seven specific defenses for the real world. Let's dig into the mechanics of these, starting with fixing the front door.

Christina

Right. So the absolute number one priority is disabling legacy authentication globally. You cannot rely on per user settings just hoping you catch everyone. You have to go into your conditional access policies and block basic authentication across all legacy protocols at the tenant level.

Adam

Wait, before we go further, when you say conditional access at the tenant level, what does that actually mean for a business owner who isn't an IT engineer? Are we just talking about a global toddl switch for the whole company?

Christina

Essentially, yes. The tenant is your entire corporate Microsoft 365 environment. And conditional access is like a highly intelligent bouncer at the door of your company.

Adam

Okay, I like that.

Christina

He doesn't just look at your ID, the password. He looks at how you are dressed, what protocol you were using to talk to him, and what country you were standing in. If you mandate it at the tenant level, you are telling that bouncer, if anyone tries to get in here using an ancient protocol like IMAP, I don't care if they have the right password, reject them instantly.

Adam

But let me play devil's advocate here. If we just flip a global switch and block all legacy protocols, won't that break older tech in the office?

Christina

Oh, it definitely might.

Adam

What about that massive 10-year-old scanner in the corner of the office that emails PDFs to people? If we turn this off, nobody can scan documents anymore, right?

Christina

That is the exact friction that prevents companies from doing this. You are absolutely right, it might break that old scanner. But the solution isn't to leave the window open for hackers. Right. The solution is to update the scanner's firmware so it supports modern authentication. Or use specific, highly restricted app passwords that can only be used by that one device for that one specific function and lock it down to your office's IP address. You do not compromise the entire company's email security for a printer.

Adam

That makes perfect sense. Okay, so the legacy windows are bricked up. The second part of fixing the front door is enforcing universal MFA. And the source is very explicit here. No exceptions.

Christina

None. You cannot have shared mailboxes like infoccompany.com without MFA. You cannot have service accounts without MFA.

Adam

And what about the CEO?

Christina

You absolutely cannot make exceptions for senior leaders or executives who complain that pulling out their phone to approve a login is annoying.

Adam

Because attackers naturally target the path of least resistance. If the CEO forces the IT department to turn off their MFA because it's inconvenient, that CEO just became the single weakest link in the entire chain.

Christina

Exactly. They are the only door the attacker needs to try.

Adam

Well, okay. Which brings us to the internal monitoring defenses, because as we saw in the case study, attackers can still find ways in.

Christina

Right. You need to leverage that conditional access bouncer to block logins from untrusted locations.

Adam

How does that work?

Christina

Well, for most small and medium businesses, their users log in from a very predictable handful of locations, usually their home state or maybe a few specific countries if they travel for work. Right. If a login comes from an unusual country at 3.0 AM, the system should either block it outright or immediately trigger a step-up authentication challenge requiring a new MFA code.

Adam

And we also need to monitor for those new device registrations we talked about. Yes. The source notes that you have to set up hard alerts whenever a new MFA device is registered on an account. But that raises an interesting operational issue. How do you tell the difference between a hacker adding a rogue device and, say, Susan in marketing just upgrading to the new iPhone over the weekend?

Christina

This raises an important question, right? And this is where the human element of IT comes in. The source makes a brilliant point here. If you get an alert that Susan registered a new device, it takes a 30-second phone call to verify.

Adam

You just call her up.

Christina

You just call her and ask, hey Susan, did you just get a new iPhone? She says yes, and you close the ticket. But an attacker registering a device that you don't catch because you didn't have alerts turned on. That results in an 11-day breach.

Adam

Yeah, that's a huge difference.

Christina

Furthermore, having impossible travel detection turned on is entirely useless if no one's looking at the dashboard. An alert that nobody reads is not a defense. It is just a historical log of your own failure.

Adam

Wow, that's a brutal way to put it, but it's true. Which brings us to the final category, regular hygiene. You can't just set up these alerts and walk away. The source recommends running quarterly texts on tools like have I been pounded or using a tool called SpeakOps Password Auditor. You take your client's email domains and actively search them against known breach databases.

Christina

And when a match appears, you don't just put it in a quarterly report and email it to the boss. Right. You treat it as a live, radioactive credential risk, and you force a mandatory password reset on that account immediately. Because remember, in this case study, there was a four-year gap between the breach and the attack. A simple quarterly check against have I been prowned would have flagged the office manager's exposed password years before the attacker ever bought the database.

Adam

That's a great point. The other hygiene step is reviewing those inbox rules and mail flow rules, the ones the attacker used to silently forward mail and shred alerts.

Christina

Very important.

Adam

The source says this needs to be a weekly check for all accounts. Any forwarding rule pointing to an external address like a Gmail or Yahoo account that an admin didn't explicitly create needs immediate investigation.

Christina

So if we step back and look at all seven of these defenses, disabling legacy auth globally, universal MFA, untrusted location blocking, impossible travel alerts, new device alerts, quarterly breach checks, and weekly inbox rule reviews.

Adam

It's quite a list.

Christina

It is, but none of these require inventing new technology. Most of them sit entirely inside tools that companies are already paying for.

Adam

But you know, none of this happens in a vacuum. If you are a business owner listening to this, or if you hire an IT provider, you need to know how this impacts the bottom line.

Christina

Absolutely.

Adam

Implementing these defenses isn't just an IT checklist that a technician can quietly do in a back room. It requires business buy-in, it requires budget, and it requires a real understanding of organizational risk.

Christina

It really does. It requires a fundamental shift in philosophy.

Adam

So what does this all mean for the IT providers out there?

Christina

Well, IT providers have to move from being break fix shops, you know, people who just show up with a mop to clean up the mess after an incident happens, to being security-led providers that actively prevent the incident from ever occurring.

Adam

But that requires a difficult conversation about license upgrades, right?

Christina

It does.

Adam

Let's talk about the friction of the upsell reality. To implement things like the intelligent conditional access bouncer we talked about, you need a specific Microsoft license called Intra ID P1. And according to the source, that is included in the premium tiers like Microsoft 365 business premium, but it is not included in the basic or standard peers. So your IT guy has to come to you and say, I need you to pay a few dollars more per user per month.

Christina

Which can be a tough sell. But it is a genuine risk conversation. The cost difference between a standard license and a premium license is minuscule compared to the financial devastation of a single credential breach.

Adam

Like where an attacker intercepts a wire transfer and redirects a $50,000 invoice.

Christina

Exactly.

Adam

And we haven't even touched the cyber insurance angle. The source points out that many cyber insurance policies now mandate universal MFA as a strict, non-negotiable baseline condition of coverage.

Christina

Yeah, that's huge.

Adam

Imagine an investigator flying out after a breach, looking at your logs, and finding out that legacy protocols were left open bypassing the MFA. That insurance claim for your lost revenue could be heavily reduced or entirely rejected. You paid premiums for years and you get nothing because you left the window open.

Christina

Which is exactly why IT professionals have to explain this to non-technical business owners effectively. You cannot use jargon.

Adam

Right.

Christina

If you walk into a CEO's office and start talking about IMAP deprecation and Entra ID Conditional Access policies, their eyes are just gonna glaze over. You have to keep it concrete.

Adam

So if I'm a stubborn business owner who thinks cyber attacks only happen to Fortune 500 companies, how do you pitch it to me? Why should I care?

Christina

I would say exactly what the source recommends. I'd say a list of your employees' email addresses and passwords from an old data breach is available for purchase online right now. Automated tools are testing those passwords against your systems every single day.

Adam

Wow.

Christina

If any of your staff are using the same password they used four years ago, someone might already have access to your sensitive files without needing to hack a single thing.

Adam

That definitely paints a picture.

Christina

And then you deliver the knockout punch. You don't just tell them, you show them. You pull up, have they been cleaned on your laptop, you type in their company domain, and you let them look at the results.

Adam

Just show them their own exposed emails.

Christina

Yes. Seeing their own employees' email addresses listed in a known breach database is a brilliant, undeniable wake-up call. It completely removes the abstraction. It is no longer a theoretical cyber threat happening to someone else. It is their actual data exposed today.

Adam

It makes it incredibly real. Look, threat actors are not always sophisticated masterminds. More often than not, they are just opportunistic. They are relying on old passwords, outdated legacy protocols that you forgot to turn off, and a complete lack of active monitoring. Yep. For you listening to this, you now have a clear blueprint. You know exactly what to look for and what questions to ask your IT team. You need to check your own organization's exposure today because those breach credentials are out there right now. It's a ticking clock. The automated scripts are running, and the only question is whether the password they have still works on your systems.

Christina

Absolutely. And you know, as we wrap up, I want to leave you with one final thought to consider. Something that really struck me regarding the sources mention of regulatory notification obligations and the need to review 90-day audit logs.

Adam

Okay.

Christina

What is well we spent this entire deep dive focusing on how to stop an attacker from stealing money or how to stop them from locking you out of your own business? But consider the reality of those 11 days. This specific attacker was silently sitting inside the network.

Adam

Just watching.

Christina

Just watching. If an attacker downloads your sensitive HR files, client contracts, and monitors your private internal communications, but it are caught before they ever steal a single dollar. How do you legally and ethically quantify that damage? Oh wow. The money is safe, but the trust is gone. Are you prepared for the agonizing, embarrassing process of reviewing 90 days of audit logs just so you can explain an invisible 11 day breach to your clients and your employees?