BYPASSING OKTA'S PASSWORDLESS MFA: TECHNICAL ANALYSIS AND DETECTION

Summary from the TLDR InfoSec newsletter

Okta FastPass is a cryptographic MFA that facilitates passwordless authentication by creating a device-bound Proof of Possession factor upon device enrollment. OktaTerrify is a tool that can be used in conjunction with OktaInk in a workflow described in the article to bypass Okta FastPass and backdoor an Okta account on a compromised host. The article also provides examples of detecting this workflow in the Okta audit log.