1.2 million Microsoft accounts hacked in January

Microsoft announced in January last year that a total of 1.2 million users were taken over by hackers. A significant portion of these cases occurred because users did not use multi-factor authentication.

It is becoming more and more important to take appropriate measures to secure our online accounts. Password protection and dual -factor identity authentication methods such, is considered to be very useful against the seizure by malicious people of your online accounts.

Speaking at the RSA Conference, Microsoft officials announced that 99.9 percent of the hijacked accounts found that their users did not use multi-factor authentication (MFA). Receiving over 1 billion active users and 30 million monthly sign-on requests, Microsoft announced that 1.2 million users' accounts were seized last January . It is stated that the rate of accounts seized every month is around 0.5 percent.

Password injection and repetitive password are the most common attack methods

According to data released by Microsoft, only 11 percent of all users signed in using MFA in January. According to officials, a substantial majority , if not all, of 1.2 million accounts could have been saved if MFA was used at each login .

Among the most commonly used method in which attackers password spraying (spraying password) and recurrent password (password replaying) attacks. Password blasting is known to be the attack of providing unauthorized access to a large number of accounts with frequently used weak passwords and password guessing. In recurring password attacks, the user's login information from other services is compromised. The fact that users tend to use the same passwords on different platforms increases the effect of this attack.

Along with multi-factor authentication, logging is made multi-layered to increase security. Among these, the one-time password ( OTP ) sent via SMS comes to the fore, but more advanced hardware-based solutions are on the agenda. In addition , technology companies such as  WebAuthn are targeting encrypted login technologies.

Microsoft officials state that attackers mostly  target old authentication protocols that do not support MFA, such as POP and  SMTP . In addition, disabling these legacy authentication protocols from a system is pretty tedious. Microsoft has detected a 67 percent reduction in account hacking among users who have disabled these legacy authentication protocols . For this reason, the company recommends that the old authentication protocols be mixed into history.