This prompted me to research the origin and flow of these tokens. The entire process took many days as I was not familiar with SfB protocols at all, nor did I know the rabbit hole I was getting into.Īfter a few attempts that included code injection into the process, sniffing and trying to break parts of the encryption, I was able to use the tokens provided for Skype to communicate with users and extract information about the tenant that I should not have been able to get without MFA.

I started digging into the protocols used, the implementation and the flow of data between different endpoints. In some scenarios with some IdPs, SfB did not ask for MFA during the login even though MFA was always enabled for this tenant. When testing the common application Skype for Business (SfB), and how it communicates with its servers and the IdP, an inconsistency came to my attention. In this blog post, I will elaborate on some of the technical details on how attackers bypass MFA.ĭuring my research on how MFA can be bypassed, I researched many protocols, applications and directions, but one stood out. I tested several Identity Provider (IdP) solutions and demonstrated the vulnerabilities with Okta and OneLogin, who had already resolved these security issues. I demonstrated new vulnerabilities that bypassed MFA and showed how an attacker could act on behalf of the account holder, which includes full access to Office 365/Azure development and production environments, email, email rules, cloud apps and more.

A few weeks ago, I gave a presentation at Proofpoint Protect Global on the common methods of bypassing multi-factor authentication (MFA) and summarized my findings in this recent blog post.

Bypassing skype microsoft account