Lesson 4.2: Talking past the help desk: MFA reset attacks
Since 2023 several groups, most visibly the one tracked as Scattered Spider, have broken into large companies without any exploit: they call the IT help desk, pretend to be an employee (often an administrator) using details found online, and ask for a password or MFA reset. In 2023 the identity provider Okta warned its customers about exactly this pattern, followed by attackers granting themselves admin rights and adding a second identity provider to impersonate any user. In the lab you follow such an attack through Northwind's help-desk tickets and identity provider log, and contain it.
17 min
You will learn to
- Explain help-desk social engineering
- Correlate tickets with identity-provider events
- Spot a session from an unexpected place after an MFA reset
- Find privilege grants and new identity providers
- Design verification that resists impersonation
Key terms
- Vishing
- Voice phishing: social engineering over the phone.
- MFA reset
- Removing a user's enrolled factors so they can enrol new ones.
- Identity provider (IdP)
- The service that authenticates users for many applications.
- Inbound federation
- Trusting another IdP to sign users in; abused to impersonate anyone.
- Identity proofing
- Verifying someone is who they claim before issuing or recovering credentials.
← Migrating password hashes · All lessons · Security controls: preventive, detective, corrective →