Windows 10: Time to hang up SMS and voice Multi-Factor Authentication mechanisms

Brink · Nov 11, 2020

In my blog Your Pa$$word doesn't matter, I laid out the key password vulnerabilities, and in response to a gazillion âbut other creds can be compromised, tooâ DMs and emails, I wrote All our creds are belong to us, where I outlined vulnerabilities in credentials other than passwords and highlighted the promise of passwordless, cryptographically protected creds like FIDO, Windows Hello, and the Authenticator App.

Today, I want to do what I can to convince you that itâs time to start your move away from the SMS and voice Multi-Factor Authentication (MFA) mechanisms. These mechanisms are based on publicly switched telephone networks (PSTN), and I believe theyâre the least secure of the MFA methods available today. That gap will only widen as MFA adoption increases attackersâ interest in breaking these methods and purpose-built authenticators extend their security and usability advantages. Plan your move to passwordless strong auth now â the authenticator app provides an immediate and evolving option.

It bears repeating, however, that MFA is essential â we are discussing which MFA method to use, not whether to use MFA. Quoting an earlier blog, âMulti-factor Authentication (MFA) is the least you can do if you are at all serious about protecting your accounts. Use of anything beyond the password significantly increases the costs for attackers, which is why the rate of compromise of accounts using any type of MFA is less than 0.1% of the general population.â

The Usual Suspects

Itâs worth noting that every mechanism to exploit a credential can be used on PSTN â OTP. Phish? Check. Social? Check. Account takeover? Check. Device theft? Check. Your PSTN account has all the vulnerabilities of every other authenticator and a host of other issues specific to PSTN.

Not Adaptable

Because so many devices rely on receiving PSTN messages, the format of the messages is limited â we canât make the messages richer, or longer, or do much of anything beyond sending the OTP in a short text message or a phone call. One of the significant advantages of services is that we can adapt to user experience expectations, technical advances, and attacker behavior in real-time. Unfortunately, the SMS and voice formats arenât adaptable, so the experiences and opportunities for innovations in usability and security are very limited.

Transmitted in the Clear

When SMS and voice protocols were developed, they were designed without encryption. From a practical usability perspective, we canât overlay encryption onto these protocols because users would be unable to read them (there are other reasons too, like message bloat, which have prevented these from taking hold over the existing protocols). What this means is that signals can be intercepted by anyone who can get access to the switching network or within the radio range of a device. As I said in the earlier âAll Your Credsâ blog, âan attacker can deploy a software-defined-radio to intercept messages, or a nearby FEMTO, or use an SS7 intercept service to eavesdrop on the phone traffic.â This is a substantial and unique vulnerability in PSTN systems that is available to determined attackers.

Easy to Social Engineer

Itâs worth noting that most PSTN systems are backed by online accounts and rich customer support infrastructure. Sadly, customer support agents are vulnerable to charm, coercion, bribery, or extortion. If these social engineering efforts succeed, customer support can provide access to the SMS or voice channel. While social engineering attacks impact email systems as well, the major email systems (e.g. Outlook, Gmail) have a more developed âmuscleâ for preventing account compromise via their support ecosystems. This leads to everything from message intercept, to call forwarding attacks, to SIM jacking.

Subject to Mobile Operator Performance

Unfortunately, PSTN systems are not 100% reliable, and reporting is not 100% consistent. This is region and carrier dependent, but the path a message takes to you may influence how long it takes to get and whether you get it at all. In some cases, carriers report delivery when delivery has failed, and in others, delivery of messages can take a long enough time that users assume messages have been unable to get through. In some regions, delivery rates can be as low as 50%! Because SMS is âfire and forget,â the MFA provider has no real-time signal to indicate a problem and has to rely on statistical completion rates or helpdesk calls to detect problems. This means signal to users to offer alternatives or warn of an issue is difficult to provide.

Subject to Changing Regulations

Due to the increase in spam in SMS formats, regulators have required regulations on identifying codes, transmit rates, message content, permission to send, and response to messages like âSTOP.â Unfortunately, however, these regulations change rapidly and are inconsistent from region to region and can (and have) resulted in major delivery outages. More outages, more user frustration.

Limited Context

In practical terms, the text or voice mediums limit how much information can be communicated to a user â SMS carries 160 characters, 70 if not using GSM, and once we get into languages which require encoding, the practical limit without message splitting is only around half that. Phishing is a serious threat vector, and we want to empower the user with as much context as possible (or, using Windows Hello or FIDO, make phishing impossible) â SMS and voice formats restrict our ability to deliver the context under which authentication is being requested.

Authentication Evolved

Ok, to recap: youâre GOING to use MFA. Which MFA? Well, for most users on their mobile devices, we believe the right answer is app-based authentication. For us, that means the Microsoft Authenticator. The Authenticator uses encrypted communication, allowing bi-directional communication on authentication status, and weâre currently working on adding even more context and control to the app to help users keep themselves safe. In just the last year, weâve added app lock, hiding notifications from the lock screen, sign-in history in the app, and more â and this list will have grown by the time you plan your deployment, and keep growing while SMS and voice keep sitting still.

Hang up on PSTN and pick up the Microsoft Authenticator â your users will be happier and more secure because you did.

Stay safe out there,

Alex
Click to expand...

Source: https://techcommunity.microsoft.com/...n/ba-p/1751752

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

:)

Brink · Nov 11, 2020

Time to hang up SMS and voice Multi-Factor Authentication mechanisms

In my blog Your Pa$$word doesn't matter, I laid out the key password vulnerabilities, and in response to a gazillion “but other creds can be compromised, too” DMs and emails, I wrote All our creds are belong to us, where I outlined vulnerabilities in credentials other than passwords and highlighted the promise of passwordless, cryptographically protected creds like FIDO, Windows Hello, and the Authenticator App.

Today, I want to do what I can to convince you that it’s time to start your move away from the SMS and voice Multi-Factor Authentication (MFA) mechanisms. These mechanisms are based on publicly switched telephone networks (PSTN), and I believe they’re the least secure of the MFA methods available today. That gap will only widen as MFA adoption increases attackers’ interest in breaking these methods and purpose-built authenticators extend their security and usability advantages. Plan your move to passwordless strong auth now – the authenticator app provides an immediate and evolving option.

It bears repeating, however, that MFA is essential – we are discussing which MFA method to use, not whether to use MFA. Quoting an earlier blog, “Multi-factor Authentication (MFA) is the least you can do if you are at all serious about protecting your accounts. Use of anything beyond the password significantly increases the costs for attackers, which is why the rate of compromise of accounts using any type of MFA is less than 0.1% of the general population.”

The Usual Suspects

It’s worth noting that every mechanism to exploit a credential can be used on PSTN – OTP. Phish? Check. Social? Check. Account takeover? Check. Device theft? Check. Your PSTN account has all the vulnerabilities of every other authenticator and a host of other issues specific to PSTN.

Not Adaptable

Because so many devices rely on receiving PSTN messages, the format of the messages is limited – we can’t make the messages richer, or longer, or do much of anything beyond sending the OTP in a short text message or a phone call. One of the significant advantages of services is that we can adapt to user experience expectations, technical advances, and attacker behavior in real-time. Unfortunately, the SMS and voice formats aren’t adaptable, so the experiences and opportunities for innovations in usability and security are very limited.

Transmitted in the Clear

When SMS and voice protocols were developed, they were designed without encryption. From a practical usability perspective, we can’t overlay encryption onto these protocols because users would be unable to read them (there are other reasons too, like message bloat, which have prevented these from taking hold over the existing protocols). What this means is that signals can be intercepted by anyone who can get access to the switching network or within the radio range of a device. As I said in the earlier “All Your Creds” blog, “an attacker can deploy a software-defined-radio to intercept messages, or a nearby FEMTO, or use an SS7 intercept service to eavesdrop on the phone traffic.” This is a substantial and unique vulnerability in PSTN systems that is available to determined attackers.

Easy to Social Engineer

It’s worth noting that most PSTN systems are backed by online accounts and rich customer support infrastructure. Sadly, customer support agents are vulnerable to charm, coercion, bribery, or extortion. If these social engineering efforts succeed, customer support can provide access to the SMS or voice channel. While social engineering attacks impact email systems as well, the major email systems (e.g. Outlook, Gmail) have a more developed “muscle” for preventing account compromise via their support ecosystems. This leads to everything from message intercept, to call forwarding attacks, to SIM jacking.

Subject to Mobile Operator Performance

Unfortunately, PSTN systems are not 100% reliable, and reporting is not 100% consistent. This is region and carrier dependent, but the path a message takes to you may influence how long it takes to get and whether you get it at all. In some cases, carriers report delivery when delivery has failed, and in others, delivery of messages can take a long enough time that users assume messages have been unable to get through. In some regions, delivery rates can be as low as 50%! Because SMS is “fire and forget,” the MFA provider has no real-time signal to indicate a problem and has to rely on statistical completion rates or helpdesk calls to detect problems. This means signal to users to offer alternatives or warn of an issue is difficult to provide.

Subject to Changing Regulations

Due to the increase in spam in SMS formats, regulators have required regulations on identifying codes, transmit rates, message content, permission to send, and response to messages like “STOP.” Unfortunately, however, these regulations change rapidly and are inconsistent from region to region and can (and have) resulted in major delivery outages. More outages, more user frustration.

Limited Context

In practical terms, the text or voice mediums limit how much information can be communicated to a user – SMS carries 160 characters, 70 if not using GSM, and once we get into languages which require encoding, the practical limit without message splitting is only around half that. Phishing is a serious threat vector, and we want to empower the user with as much context as possible (or, using Windows Hello or FIDO, make phishing impossible) – SMS and voice formats restrict our ability to deliver the context under which authentication is being requested.

Authentication Evolved

Ok, to recap: you’re GOING to use MFA. Which MFA? Well, for most users on their mobile devices, we believe the right answer is app-based authentication. For us, that means the Microsoft Authenticator. The Authenticator uses encrypted communication, allowing bi-directional communication on authentication status, and we’re currently working on adding even more context and control to the app to help users keep themselves safe. In just the last year, we’ve added app lock, hiding notifications from the lock screen, sign-in history in the app, and more – and this list will have grown by the time you plan your deployment, and keep growing while SMS and voice keep sitting still.

Hang up on PSTN and pick up the Microsoft Authenticator – your users will be happier and more secure because you did.

Stay safe out there,

Alex
Click to expand...

Source: https://techcommunity.microsoft.com/...n/ba-p/1751752

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

Aditya_Roy · Nov 11, 2020

log to a computer using multi-factor authentication server

Hi,

Thank you for writing to Microsoft Community Forums.

We understand your concern as you are looking options for implementing two factor authentication with the Azure multi-factor authentication sever.
I would suggest you to refer the article on
Getting started with the Azure Multi-Factor Authentication Server which contains information that could prove itself useful to you.

However, as your query is related to Azure Multi-Factor Authentication Sever. I would suggest you to post your query in
TechNet forums, where we have experts and support professionals
who are well equipped with the knowledge on Azure multi-factor authentication sever to assist you with the appropriate troubleshooting steps.

We await your response.

Aditya Roy

Microsoft Community – Moderator

RicardoRodriguez90 · Nov 11, 2020

Multi-factor authentication on Windows 10

Hi Varunn,

Yes there are ways for the multifactor authentication being set. This will require some working on the domain controller. Here is a link of a way Microsoft suggest multifactor authentication:

https://blogs.technet.microsoft.com/cbernier/20...

You can also use the Windows Bitlocker tool to encrypt the disk and since you enter a fixed password it's basically multifactor authentication. One password to decrypt the disk and then the password for the domain.

Let us know if you need anything else. We are here to help you out.

Windows 10: Time to hang up SMS and voice Multi-Factor Authentication mechanisms

Time to hang up SMS and voice Multi-Factor Authentication mechanisms

Time to hang up SMS and voice Multi-Factor Authentication mechanisms

Time to hang up SMS and voice Multi-Factor Authentication mechanisms

Time to hang up SMS and voice Multi-Factor Authentication mechanisms - Similar Threads - hang SMS voice

Multi Factor Authentication device unlock

Multi Factor Authentication device unlock

Multi Factor Authentication device unlock

How to download Microsoft multi factor authentication on a laptop?

Multi-factor Unlock

How to create a multi-factor authentication MFA app?

Regedit locking out the command with Multi-factor authentication

log to a computer using multi-factor authentication server

Skype for Business and Multi-Factor Authentication with DUO