MFA: Stories that make you go 'Huh?'
summary
Shows concrete, repeatable failures: SMS and TOTP codes accepted after reuse, QR seeds reissued in sessions, and OTP reuse that never expires; web flows that leak MFA setup pages and user-agent spoofing that skips device checks; Azure conditional access gaps that let admin APIs or PowerShell bypass MFA and default Enta device registration that any user can enroll via responder or Evil Gen X style attacks. Each case includes how the bypass works, what was built to test it, and practical fixes.
AI-written summary · about
chapters (15)
- 0:00MFA pitfalls and stories
- 1:05Passwords insufficient for security
- 4:37How MFA works and methods
- 7:26SMS-based MFA mistakes
- 9:33Web app MFA flaws
- 18:45Cloud MFA risks
- 19:05Conditional access in Microsoft
- 24:48User agent bypass risks
- 28:29Guest Wi-Fi MFA exclusion
- 31:18Azure MFA management gaps
- 35:59Trusted devices weak factor
- 39:08Password reset vulnerabilities
- 41:17Robust MFA best practices
- 43:25Passwordless and passkeys
- 44:31Summary
related talks
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
38mAnatomy of the Attack: The Rise and Fall of MFA
50mOne Does Not Simply Add MFA
26mMake MFA More Resilient
42mBreaking the Next Factor - Evil will pwn you LIVE tonight
47mBreaking the Next Factor – Live Multi-Factor Authentication (MFA) Hacking
51mMobile MFA Madness: Mobile Device Hygiene and MFA Integrity Challenges
47mThreat Modelling Stories From The Trenches