tag: Authentication · 7 items
- Engineer — Plan: Entra ID SMS first-factor sign-in retires February 2027 — begin migrating users to passkeys or other phishing-resistant methods this quarter to avoid sign-in disruptions before the deadline.
- SOC/IR — Skip
- Leader — Plan: Confirm a funded migration roadmap is in place to move Entra ID users off SMS first-factor before the February 2027 cutover; delays could cause sign-in outages and customer-facing disruption.
- Engineer — Act: Apply Microsoft’s documented workaround now if you’ve deployed September 2026 Windows 11 updates and have domain-joined endpoints experiencing authentication failures; review patch deployment rollout to contain blast radius.
- SOC/IR — Plan: Authentication failures from patch regression can mask or mimic credential attacks; note the September 2026 Windows 11 update timeline when triaging domain login anomalies to avoid false-positive escalations.
- Leader — Skip
- Engineer — Learn: Academic research exposing trust hijacking and credential leakage flaws in carrier-based SSO; the finding that 69.4% of MSSO sites expose developer credentials is a useful design caution for any team integrating telecom-backed identity flows, though MSSO is rare in typical US cloud stacks.
- SOC/IR — Learn: The One-Click-to-Leak attack class (phone number exfiltration via single page visit) is a novel auth-layer technique worth filing for threat modeling, but the paper provides no IOCs, ATT&CK mappings, or detection rules to act on today.
- Leader — Skip
- Engineer — Learn: Novel attack taxonomy spanning enrollment, credential sync, recovery, and prompt abuse—none break FIDO2 crypto but all exploit surrounding trust boundaries. Use this to audit your passkey rollout design and recovery flow assumptions; no patch or config change is required today.
- SOC/IR — Learn: No active exploitation, IOCs, or ATT&CK-mapped TTPs are present, but understanding these authentication-layer abuse paths could sharpen future detection logic around anomalous passkey enrollment and recovery events.
- Leader — Plan: If the organization is actively deploying or roadmapping passkeys, this research warrants a review of vendor implementation choices and recovery-path risk this quarter—39 documented bypass methods is a meaningful input to a passkey adoption strategy.
- Engineer — Plan: If you’re deploying or have deployed cloud-synced passkeys, evaluate migrating to hardware-bound (device-local) passkeys where possible; the research shows synced passkey material can be exfiltrated by malware and Windows-issued signed auth tokens can be replayed — audit your passkey configuration to prefer non-synced, phishing-resistant authenticators.
- SOC/IR — Learn: These attacks require malware already present on the endpoint, making detection of credential-theft behaviors (auth token exfiltration, suspicious cloud-sync API calls) the relevant angle — no published IOCs or ATT&CK mappings yet, but worth revisiting passkey-related telemetry if new technique details emerge.
- Leader — Learn: Passkey rollouts sold internally as phishing-proof may need a qualification: device-bound variants maintain that property but cloud-synced ones carry residual risk if endpoints are compromised — useful context for board decks or vendor questionnaire responses that reference passkey adoption.
- Engineer — Plan: Audit your WebAuthn/passkey relying party implementation to confirm the User Verified flag is enforced; if your app accepts assertions without UV=true, you’ve silently degraded MFA to single-factor auth.
- SOC/IR — Learn: No exploitation in the wild reported and no IOCs available; useful for understanding how passkey bypass could appear in authentication logs if UV flag checks are absent.
- Leader — Skip
- Engineer — Learn: A PAM-level biometric hook for sudo is worth evaluating before someone on your team installs it on a managed Mac; understand what attack surface a local face-recognition bypass introduces before adopting or banning it.
- SOC/IR — Skip
- Leader — Skip