Conclusions:
1. Anything that doesn't have 2fa is leaking like a sieve.
2. The targeted company needs to implement 2fa for their Wifi as well.
Not mentioned, but I assume that their 2fa is using specialised hardware gadgets like Yubikey and not texts or totp, because else they could target the cell phones, and like everything else they are leaking, or they are attacking the cell phone base stations.
Final conclusion:
A network is as strong as the weakest link. In that case Wifi was not protected by strong 2fa and could be used to breach.
A separate VPN, with MFA, should be required to access anything.
Final conclusion: Do not trust a device just because it happens to be on your local network.
Depends on how you look at it. We have end-to-end security with things like https, so we don't need to worry about the links in the middle.
Wifi with 802.1X and certs would have been fine here without MFA.
On-prem systems prompt for 2FA. So the attacker knew a user/password combo, but couldn't leverage it directly because they would have triggered 2FA.
But the 802.1x didn't have 2FA enabled. So using the user/password combo they already had, they just needed to approach the target network over WiFi in order to bypass the 2FA requirement.
These guys hacked into a machine connected by ethernet with an idle wifi adapter, then used that idle wifi adapter to connect to the wifi of a company nearby.
And having an idle wifi adapter like that is common nowadays. For some reason, many desktop PCs intended to stay in a single fixed place come from factory with a built-in wifi card and built-in antennas. You'd think that would make these PCs more expensive, but apparently wifi cards are cheap nowadays?
The real news is that the wifi didn't use 2FA like the rest of the system.
This would be nothing new, I remember ages ago in the days of WEP that you could buy a small box that would collect enough handshakes to let you crack the WEP password.
It's a scary thing as all you have to do is add one decision, one ignorant person and it's bad news.
I've worked in orgs where we made big leaps in security, very proud of our work. Then one ignorant person who had the authority made a decision with no valid benefit to anyone, completely compromised everything.
Seen it time and again.
Not sure if that was the case as far as the credentials went in this situation, but it always seems to be the human element as far as curious choices goes.
This is the kind of hackery I'd enjoy seeing in a blockbuster movie.
