Researchers from Oasis Security have uncovered a critical vulnerability in Microsoft Azure’s multifactor authentication system, allowing them to bypass security measures in just one hour. This flaw, attributed to a lack of rate limiting on login attempts, exposed over 400 million paid Microsoft 365 accounts to potential takeovers. The researchers demonstrated their “AuthQuake” method, which involved rapidly creating new sessions and exhausting the options for six-digit codes. Their testing revealed that attackers had an extended timeframe of up to three minutes to guess a code, significantly increasing their chances of success. Although Microsoft acknowledged and fixed the issue by implementing stricter rate limits, experts still emphasize the importance of using strong authentication methods and alerting users of failed login attempts to enhance security.
In a startling revelation, security researchers at Wallarm have found that newly deployed application programming interfaces, or APIs, are discovered by attackers in an average of just 29 seconds. Their study involved setting up a honeypot, revealing that the most targeted port was port 80, accounting for 19 percent of attacks. Notably, over half of all requests, at 54.4 percent, targeted APIs rather than traditional web applications. Common endpoints like “/status” and “/health” posed significant risks, as they were typically found in under two minutes. The findings emphasize the urgent need for organizations to adapt their security practices to protect against the rapidly growing API attack surface.
The Cybersecurity and Infrastructure Security Agency, the National Security Agency, and the Federal Bureau of Investigation have released a new guide to bolster defenses against cyber threats from the Chinese government. This guide, titled “Enhanced Visibility and Hardening Guidance for Communications Infrastructure,” targets network engineers and aims to enhance the security of telecommunications networks. It outlines best practices for identifying vulnerabilities and responding to cyber incidents, emphasizing the serious threat posed by Chinese-affiliated cyber activities to critical infrastructure and businesses. The guide also encourages software manufacturers to adopt secure development principles. The FBI has reported that threat actors linked to China have targeted commercial telecommunications providers to compromise sensitive data. Organizations are urged to implement the recommended measures and report any suspicious activities.
If you want more, I’m also linking to an Axios article on the issues within telecom networks and their long history.
The vulnerability in Microsoft’s Azure MFA system highlights a systemic issue: security measures are only as effective as their implementation. The Azure MFA and API vulnerabilities show a recurring problem: organizations often react to security issues rather than proactively identifying weak points. IT providers must shift to offense-driven security strategies, such as regular penetration testing and red-teaming exercises. Patch complacency remains a risk. Even when vulnerabilities are fixed, attackers adapt quickly, exploiting new flaws or organizations slow to update.
Wallarm’s research shows just how quickly APIs are exposed to attackers—29 seconds for discovery and under two minutes for endpoint targeting. As APIs become more integral to cloud-based and application ecosystems, this level of exposure represents a massive attack surface. Despite the push toward zero trust architectures, APIs often fall outside traditional security frameworks. Companies may inadvertently weaken their defenses by failing to integrate API security into their broader zero-trust strategies.
And as always, take advantage of the resources offered.