Troubleshooting Distributed Brute Force and/or Password Spray Attacks in Okta
Last Updated:
Overview
Distributed brute force and password spray attacks occur when legacy protocols like Internet Message Access Protocol (IMAP), Post Office Protocol (POP), and Simple Mail Transfer Protocol (SMTP) remain enabled in Microsoft. Disable these legacy protocols in Microsoft Office 365 and implement Okta security features like soft lock, IP blocking, and Adaptive Multi-Factor Authentication (MFA) to mitigate these attacks.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Microsoft Office 365
- Brute Force Attacks
- Password Spray Attacks
Cause
Legacy protocols, including IMAP, POP, and SMTP, remain enabled in Microsoft.
Solution
What indicates an unauthorized authentication attempt?
Review the authentication entries in the Okta System Log to identify the IP addresses, regions, and application endpoints associated with suspected unauthorized attempts.
- Navigate to the System Log in the Okta Admin Console.
- Expand the authentication entries to review the IP addresses, regions, and application endpoints.
The following image shows the specific Okta URL endpoint to which Microsoft sends the authentication request for legacy protocol traffic.
The /wsfed/active endpoint handles all legacy protocol traffic sent by Microsoft for authentication. Legacy email protocols used by native mail clients, such as IMAP and POP, cannot process client access policies or MFA. This presents a significant security risk, as attackers who acquire user credentials bypass MFA challenges when using a legacy protocol.
Disable legacy protocols in Microsoft Office 365.
Disable legacy protocols in Microsoft Office 365 tenants to prevent unauthorized access. Refer to the Microsoft Support documentation for instructions: How to enable or disable POP3, IMAP, MAPI, Outlook Web app, or Exchange ActiveSync for a mailbox in Office 365.
Okta provides additional information on locking down legacy protocols and configuring secure client access policies in the following whitepaper: Securing Office 365 with Okta.
What commands disable Simple Mail Transfer Protocol basic authentication?
Execute the following commands to disable SMTP basic authentication according to Microsoft documentation.
Set-CASMailbox -Identity user@example.com -SmtpClientAuthenticationDisabled $true
Set-TransportConfig -SmtpClientAuthenticationDisabled $trueFollowing the Microsoft documentation for Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online, using the parameter null applies the tenant setting to the user. Using the $true value disables SMTP basic authentication.
Implement Okta mitigation methods.
Configure the following out-of-the-box Okta features to mitigate brute force and password spray attacks.
- Soft Lock: Prevents lockouts to Active Directory (AD) accounts. Use this feature in conjunction with the auto-unlock functionality for Okta accounts on the Authentication page in the Okta Admin Console.
- IP Blocking: Blocks specific IP addresses from accessing the Okta tenant.
Configure the following Adaptive MFA features to provide additional security against attacks.
- Geo Location Zones and Blocking: Blocks entire geographic zones or creates specific policies.
- Behavior Detection: Identifies and responds to unusual user activity.
- Device Trust: Ensures only managed devices access Okta applications.
