|
Reminder: Best Practices For Breach Prevention
The whole world has largely increased the usage of Multi-Factor Authentication (MFA) everywhere and on every conceivable level as they try to lock things down. It's a wise move that should be followed by everyone as it is extremely successful in helping stop threats from breaking through. The filp side to that is, of course, the bad actors begin to evolve and thats where MFA Bypass attacks have begun to surface.
What Are MFA Bypass Attacks?
Essentially, this is the next evolution of bad actors attempting to gain access to a user’s account. With more and more people officially implementing MFA (which should be done wherever possible), the bad actors are attempting to develop ways around that. At present, there are three common attempts at this: MFA fatigue, token theft, and Machine-in-the-middle attacks.
MFA fatigue refers to the user exhaustion or frustration caused by frequent requests for multi-factor authentication, leading to potential security vulnerabilities as users may seek shortcuts or opt out of additional security measures. This isn’t really a tech-powered attack and relies on users doing things to either circumvent MFA on their own by breaking the practices in place or by doing something like approving a sign-in attempt that they didn't really look at and may not be their own attempt.
Token theft involves unauthorized access to authentication tokens, which are used to verify a user's identity, often through interception or exploitation of vulnerabilities in the authentication process. This may be the goal of many attacks that provide a fake login page because they can not only harvest your credentials, but grab the token to go with it.
Machine-in-the-middle attacks occur when a malicious actor intercepts communication between two parties, allowing them to eavesdrop on or manipulate the exchange of data. This allows them to operate as a back-end party and collect the information needed to complete a login to the user account.
What Can Be Done?
While the first type of attack (MFA fatigue) is user-based, the others are more technologically advanced. As such, the best way to stop an MFA fatigue attack is through user training. Making sure users are aware and are not approving random requests they didn’t initiate, for example, can render this type of low-tech attack totally ineffective.
Machine-in-the-middle attacks are not up to the user themselves for the most part. The best defense against this type of attack is to have strong cyber defenses like endpoint software, firewalls, filtering, etc.
The token theft is a bit of both. Something where tighter security could help prevent it but also an instance where attempts will likely get through at some point and users should be trained enough to know to take caution when receiving unprovoked emails, if a site asks them to login unexpectedly, etc.
If you’ve got questions about MFA Bypass attacks, would like to increase your cyber security posture, or have an interest in looking at user training, please feel free to reach out to our offices. Our staff will be able to assist you with any such requests.
| 
