In last week's RSA security conference, Microsoft engineers talked about their monthly traced to 99.9% of the infected account is not enabled for multi-factor authentication (MFA), and the solution can automatically block most attacks account.
According to Microsoft's data, they are tracking more than 30 billion times a login and over 1 billion monthly users live every day. Approximately 0.5% of the average monthly account theft, in January 2020, this figure specifically about 1.2 million.
When a business account being attacked, the situation will be worse. Microsoft said that as of January 2020, in these highly sensitive accounts, only 11% enable multi-factor authentication (MFA) solutions.
The main source of most Microsoft account password is hacked spray (password spraying), attackers often choose relatively easy to guess passwords, try to crack one by one account, then use a second password in order to try to attack, and so on.
The second major attack is the password for playback (password replays), that is, using a set of data was leaked, in another attempt to sign the platform, if you repeatedly use the same account password will move in different platforms.
Microsoft Identity and Security Architect Lee Walker pointed out that 60% of users will reuse passwords, so it is best not to confuse, corporate and non-corporate environments Account should also be distinguished.
Basically these two types of attacks are carried out against the older authentication protocols such as SMTP, IMAP, POP, etc., mainly because these old MFA does not support authentication protocol solution, then very easily be exploited by hackers.
Walker reminded those organizations that use legacy authentication protocol should be disabled immediately. Microsoft's data show that the old agreement is disabled tenants, the account was decreased by 67% the rate of invasion.
In addition, Microsoft recommends that each organization should give priority to enable MFA solution for user accounts, "This will prevent 99.9% of the account was hacked."
Source: ZDNet