Multi-factor authentication (MFA) was supposed to be the silver bullet against cyber threats, but a new attack vector has emerged, exploiting its very core. MFA prompt bombing is a cunning tactic that leverages the very mechanism designed to protect us. Here's why it's a growing concern and how organizations can fortify their defenses.
The MFA Prompt Bombing Technique
At its core, MFA prompt bombing relies on a simple yet insidious strategy. Attackers use valid account credentials, often obtained from breached password dumps on the dark web, to trigger login prompts on a victim's device. The key elements of this attack are:
- Valid Credentials: Attackers need stolen login credentials to initiate the process.
- Push-Based MFA: The login portal uses push-based MFA, such as VPN, Microsoft 365, Okta, or Duo, which sends prompts to the user's device.
- Victim Interaction: The victim is repeatedly prompted to approve or deny the login attempt, often without clear context.
The attack's success hinges on the victim's interaction. Attackers may use vishing calls, posing as IT support, to socially engineer victims into approving the prompts. Once a prompt is approved, the attacker gains access, often without triggering security alerts.
Real-World Example: The Cisco Breach
The 2022 Cisco breach serves as a stark reminder of MFA prompt bombing's effectiveness. An attacker linked to the Yanluowang ransomware group compromised a Cisco employee's personal Google account, which was syncing browser-stored credentials, including the employee's Cisco VPN password.
The attacker then initiated MFA prompts on the employee's phone. Initially unsuccessful, they resorted to vishing calls, using various accents to impersonate trusted support organizations. Eventually, the employee, under social engineering tactics, approved a push notification, granting the attacker VPN access.
From there, the attacker enrolled their own devices for MFA, escalated privileges, and exfiltrated sensitive data. This breach occurred despite Cisco's robust security posture, highlighting the attack's sophistication.
Why Push MFA Falls Short
The issue lies in the reliance on user approval. Push-based MFA prompts lack context, making it challenging for users to discern legitimate requests from attacks. Repeated prompts can easily be mistaken for system glitches, especially when paired with vishing attempts.
Strengthening Defenses
Organizations can take proactive measures to counter MFA prompt bombing:
Phishing-Resistant MFA: Transitioning from push notifications to phishing-resistant methods like FIDO2 security keys, hardware tokens (e.g., YubiKey), or number-matching codes from authenticator apps enhances security. Solutions like Specops Secure Access support these fatigue-resistant options for high-risk access points.
Password Security: Implementing tools like Specops Password Auditor scans Active Directory for compromised passwords, forcing resets when matches are found. This proactive approach mitigates the risk of attackers possessing the first authentication step.
Conditional Access Policies: Adding risk signals to logins, considering geography, device posture, and login times, can block or enhance authentication. This reduces the reliance on user behavior and provides real-time context to detect suspicious activities.
MFA Evolution, Not Abolition
MFA prompt bombing doesn't render multi-factor authentication obsolete. Instead, it underscores the need for a more comprehensive approach. Organizations should consider evolving their MFA strategies, focusing on phishing-resistant methods and password security, to fortify their defenses against this emerging threat.
In the ongoing battle against cyber threats, staying one step ahead requires constant vigilance and adaptation. As attackers evolve their tactics, so must our defenses.
