No MFA, Full Access: the Hidden Risk in Duo & Generic AD Sync
What we observe time and again are privilege escalation paths that traverse from lower-tier to higher-tier objects using permissions such as GenericWrite, GenericAll, or WriteDACL. In research analyzing over 100 governmental, financial, and high-tech institutions, the prevalence of these generic permissions was found to be extremely high. Such misconfigurations introduce significant posture management risks in Active Directory environments. We further demonstrated the real-world impact of these risks by leveraging Duo MFA to showcase potential MFA bypasses.
Generic permissions in Active Directory are rights that bundle many object-specific permissions into a single grant:
Those permissions are very common in many Active Directory environments. In research that analyzed over 100 governmental, financial, and high-tech institutions, the use of those generic permissions is extremely high:
In general, these permissions let a user perform actions far beyond what’s required, for example, granting GenericAll just to reset a password. We demonstrated the risk by showing how generic permissions in AD can enable a bypass of Duo MFA.
Crucially, these risks persist because generic rights often go undetected and unreviewed; organizations don’t fully understand their impact.
Integrating third-party platforms with Active Directory (AD) is a standard enterprise practice that simplifies identity management. By synchronizing external systems with AD, organizations can reuse existing attributes, such as usernames, email addresses, and phone numbers, across multiple services. This reduces administrative overhead, minimizes redundancy, and ensures consistent access control and identity data across the environment.
Duo Security is a widely used MFA solution that helps protect user logins by requiring an additional verification step beyond an Active Directory password. Common MFA methods include push notifications, SMS passcodes, or phone calls, all designed to confirm that the authenticating user is legitimate even if credentials are compromised.
The exploration of this practical scenario is as follows:
The hypothetical Comp company intends to implement MFA for Remote Desktop Protocol (RDP) access throughout its on-premises environment. To this end, they deploy Duo Authentication for Windows Logon on all servers accessible via RDP.
Whenever a user successfully authenticates to a server with their AD credentials, Duo prompts them for a second factor to the number associated with their account.
If the user is synced from Active Directory and has a phone number set in the mobile or telephoneNumber fields, Duo will import that value if phone import is enabled. As a result, depending on the configuration, the user may be able to validate their identity using the AD-synced phone number without additional setup.
To successfully execute this attack, the following conditions must be met:
In practice, the blocker isn’t niche attribute rights; it’s generic permissions already present in many environments.
With these conditions, an attacker-controlled phone number in AD becomes a valid 2FA method activated at the next sync.
Synchronizing phone attributes from AD into Duo is convenient, but it introduces a path for abuse. If an attacker can change a user’s password and phone number in Active Directory, they can:
1. Set a malicious telephoneNumber or mobile value on the target user.
2. Wait for Duo’s next directory sync
3. Log in using the victim user’s password and click “Text me new codes.”
4. Receive an SMS passcode from Duo sent to the attacker’s own phone without needing access to Duo’s admin interface.
5. Get access to the device.
Significantly, the attacker is not required to make physical contact with Duo.
This is contingent upon both of the following conditions being satisfied:
1. Duo’s directory-sync profile has phone import enabled
2. Duo’s policy allows SMS:
3. Then, a single change in AD is enough to satisfy 2FA, effectively bypassing MFA using only LDAP writes
Understanding Duo’s default behavior is crucial to assessing the actual risk and designing effective mitigations. The following are official descriptions from Duo’s documentation regarding phone import and SMS authentication settings:
| # | Duo Feature | Description |
|---|---|---|
| 1 | Import Phone Feature | Duo’s directory sync can optionally import phone numbers from Active Directory user attributes. • Official Description: “Enable this option if you want Directory Sync to create phones for your users. Imported devices default to the “Generic Smartphone” platform, capable of phone calls and SMS messaging.” • Default Setting: Phone number import is disabled by default. |
| 2 | SMS Passcode Authentication | • Official Description: “Users receive a text message with a Duo passcode that they use to authenticate. • Default Setting: SMS-based authentication is enabled by default.” |
The following steps will improve the security of Active Directory when it is synchronized with Duo
1. Use Posture Management Platform to Model and Reduce AD Attack Paths
Leverage your organization’s security posture management tool to detect users or groups with excessive privileges in Active Directory. Focus on identifying:
These tools can typically identify risky attack paths and enable you to reduce unnecessary permissions, thereby minimizing opportunities for lateral movement.
2. Avoid Syncing Phone Attributes from Active Directory (If Possible)
Disable the import of telephoneNumber and mobile attributes during AD-to-Duo sync. Managing 2FA devices directly in Duo ensures that only verified, admin-approved methods are used for authentication, reducing reliance on potentially manipulated directory data.
3. Disable SMS and Enforce Passcode-Based MFA
Remove SMS as a 2FA option from Duo’s policy and enforce passcode-based MFA. This ensures that any user needing to register a new device must request a passcode from a Duo administrator or complete activation through the Duo SaaS portal, adding a critical administrative checkpoint before device enrolment.
Attackers who gain write access to AD user objects can change telephoneNumber or mobile attributes, which Duo may consume during the next sync cycle. To detect this:
What to Look For:
Once the phone number is changed in AD and synced to Duo, attackers can use their own device to satisfy MFA prompts.
Log Source: Duo Telephony Log (Admin Panel or API)
Indicators of Suspicion:
To better protect organizations, there is a need to operate in a few layers:
Dream AI is engineered to disclose concealed aspects, such as unspecified generic permissions, their potential avenues for misuse, and the minimal secure adjustments necessary to eliminate them.
Dream AI applies end-to-end across all layers of Active Directory security:
Together, these capabilities allow Dream to pinpoint “golden” attack paths and deliver clear, prioritized mitigation guidance to close them before they’re exploited.
