Phishers have found a way to downgrade—not bypass—FIDO MFA

[anonymous372]

Phishers have found a way to downgrade—not bypass—FIDO MFA

The end result, the security firm said, was an adversary-in-the-middle attack that tampered with the QR code process to bypass FIDO MFA. As noted earlier, writers of the FIDO spec anticipated such attack techniques and built defenses that make them impossible, at least in the form described by Expel.

What Expel seems to have encountered is an attack that downgraded FIDO MFA with some weaker MFA form.

As such, the attack is more accurately classified as a FIDO downgrade attack, not a bypass.