Microsoft: 99.9% of compromised accounts did not use multi-factor authentication

[silversurfer]

Content source

https://www.zdnet.com/article/microsoft-99-9-of-compromised-accounts-did-not-use-multi-factor-authentication/

Speaking at the RSA security conference last week, Microsoft engineers said that 99.9% of the compromised accounts they track every month don't use multi-factor authentication, a solution that stops most automated account attacks.

The cloud giant said it tracks more than 30 billion login events per day and more than one billion monthly active users.

Microsoft said that, on average, around 0.5% of all accounts get compromised each month, a number that in January 2020 was about 1.2 million.

While all account hacks are bad, they are worse when the account is for enterprise use. Of these highly-sensitive accounts, only 11% had a multi-factor authentication (MFA) solution enabled, as of January 2020, Microsoft said.

In most cases, the account hacks happen after rather simplistic attacks. The primary sources of most hacks of Microsoft accounts was password spraying, a technique during which an attacker picks a common and easy-to-guess password, and goes through a long list of usernames until they get a hit and can access an account using said password.

 

[upnorth]

 

[ForgottenSeer 85179]

Such big companies should enforce 2FA on user side.
And support new FIDO2 / WebAuthn standards which completely fix such problems

 

[Outpost]

It is absurd and irresponsible not to use 2FA. By now almost all web services offer this implementation. It should be mandatory, but at the same time, I find it disconcerting that we must get to the point of making a security function mandatory which instead should be the first voluntary and maturity choice of the end-user.

 

[BVLon]

It is absurd and irresponsible not to use 2FA. By now almost all web services offer this implementation. It should be mandatory, but at the same time, I find it disconcerting that we must get to the point of making a security function mandatory which instead should be the first voluntary and maturity choice of the end-user.

We are moving to 3-factor now... not using 2F is very irresponsible.

 

[Outpost]

We are moving to 3-factor now... not using 2F is very irresponsible.

I already use a "sort" of 3FA. Password / PIN for access => 2FA token => Fingerprint to unlock the 2FA Token

 

[BVLon]

I already use a "sort" of 3FA. Password / PIN for access => 2FA token => Fingerprint to unlock the 2FA Token

That is a classic 3FA

 

[Antus67]

1.2 million Microsoft accounts got hacked in January 2020
It's not us; it's you! Microsoft engineers said at the RSA conference that for 99.9% of hacked accounts, users did not implement multi-step authentication to provide an additional layer of security to ward off cybercriminals, ZDNet reported.

The Redmond-based tech giant revealed that it tracks more than 30 billion log-in events daily and more than one billion active users monthly. On average, 0.5% of Microsoft accounts get compromised per month. To put that statistic into perspective, that's a whopping 1.2 million accounts every 30 days or so.

"If you have an organization that has 10,000 users, 50 of them are going to be compromised this month," said Alex Weinert, Microsoft's director of identity security.

Weinert zoomed in on Microsoft enterprise accounts, and noted that only 11% enabled a multi-factor authentication solution. Weinert said that multi-step authentication is crucial because it would increase data protection against hackers' preferred method for infiltrating Microsoft accounts, which is password spraying.

Password spraying, according to ZDNet, is "a technique during which an attacker picks a common and easy-to-guess password, and goes through a long list of usernames until they get a hit and can access an account using said password."

Approximately 40% of hacked Microsoft accounts in January were compromised using password spraying.

The second-most common way that Microsoft accounts get hacked is a method called password replays. This is when a hacker snatches leaked credentials from another company and then tries it on a Microsoft account.

Unfortunately, there's a chance that the cybercriminal may find a match.

"We know that 60% of users reuse passwords. It's super common," Weinert said. "Don't be confused. People reuse their enterprise accounts in non-enterprise environments."

The vast majority of password spraying (99%) and password replay attacks (97%) that take place at Microsoft are followed through legacy authentication protocols, including SMTP, IMAP and POP.

"The reason, according to the cloud giant, is that these legacy authentication protocols don't support MFA solutions, making them ideal for hackers," ZDNet wrote.

Companies that disable legacy authentication protocols have seen a 67% reduction in account hacks.

The moral of the story here is clear: Turn on multi-step authentication for your accounts and don't be dependent on one password for all your logins.

Microsoft revealed their findings last week at the RSA security conference, an annual symposium that addresses cybersecurity concerns.