Purple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
summary
Details two practical bypasses and concrete defenses: a repeated spoofed-call attack against Azure-style phone-push MFA (caller ID spoof + annoying prerecorded prompts dialed every 5–7 minutes so victims hit pound), and smishing that spoofs bank fraud numbers to harvest OTPs. Shows account-reset as the weakest link and recommends video credential reset (live ID on video + random challenge) plus inventorying all credential types, SIEM correlation of failed attempts, two-factor reset for MFA, and a segregated credential firewall with a standby MFA.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:20Why do we need MFA
- 0:51Does MFA work
- 1:24Challenges
- 2:00Presumption of Path
- 2:33The Lock Icon
- 3:21My Hobby
- 3:37Motorcycle Cover
- 4:20TSA Locks
- 4:36Master Keys
- 4:56Tents
- 5:12Motorcycle Covers
- 6:27Armor all the paths
- 7:27Identify broken factors
- 9:39Lowtech hacks
- 13:00SMS Phishing
- 14:42Brother Orange
- 16:16Mobile Authentication
- 17:39Account Reset
- 18:42Password Reset
- 20:05Video Credential Reset
- 21:56Credentials
- 25:01Password Probes
- 25:51Credential Firewall
- 29:29Armor Up
- 30:47Next Week
related talks
45mMFA: Stories that make you go 'Huh?'
47mBreaking the Next Factor – Live Multi-Factor Authentication (MFA) Hacking
50mOne Does Not Simply Add MFA
42mBreaking the Next Factor - Evil will pwn you LIVE tonight
38mAnatomy of the Attack: The Rise and Fall of MFA
26mMake MFA More Resilient
48m2FA2Furious: New Threats to MFA
30mAuthentication Strategies to Protect Your Customers and Your Brand from Sophisticated Attacks