RESEARCHERS CRACK MICROSOFT AZURE MFA IN AN HOUR

Summary from the TLDR InfoSec newsletter

Researchers from Oasis Security discovered an MFA bypass on one of Microsoft Azure's MFA methods that could lead to the compromise of Microsoft 365 accounts. The researchers discovered that the endpoint did not implement rate limiting and that the auth period lasted for a full three minutes as opposed to the recommended 30 seconds. The researchers also discovered that an attacker could rapidly make many auth attempts to enumerate the full 6-digit MFA space.