Exploiting the O365 Duo 2FA Misconfiguration
Cassandra Young demonstrates a misconfiguration in Microsoft 365 Duo 2FA implementations that allows mobile email clients to bypass two-factor prompts.
Summary
The Mechanics of Multi-Factor Authentication in Office 365
Organizations frequently integrate third-party identity providers (such as Cisco Duo) with Microsoft 365 to enforce multi-factor authentication across enterprise mailboxes.
Discovering the Mobile Client Authentication Loophole
Cassandra Young reveals how incomplete conditional access rules and legacy ActiveSync / basic authentication protocols create an authentication bypass.
Executing 2FA Bypasses on Mobile Endpoints
By spoofing specific mobile user-agent headers and basic authentication endpoints, an attacker with stolen credentials authenticates directly to Exchange Online without triggering Duo prompts.
Remediating Duo and Azure Conditional Access Policies
Young provides administrators with step-by-step conditional access configurations to enforce modern authentication and block legacy protocol bypasses.
Related talks
Videos·48 min
Andrea Pierini
Andrea Pierini examines Reflecting Your Authentication: Look In The Mirror - It’s You.
Black Hat Europe 2025·30 min
Zak Fedotkin
Industry experts analyze emerging threats surrounding The Fragile Lock: Novel Bypasses For SAML Authentication.
Briefings·33 min
Hayato Kimura · Ryoma Ito · Kazuhiko Minematsu · Shogo Shiraki · Takanori Isobe
Nostr is an emerging open-source, decentralized social networking protocol with over 1.1 million users—and a critical blind spot in its security design.