Multifactor authentication is a security measure that requires users to provide a second form of verification before they can log into a corporate network. It has long been considered essential for keeping fraudsters out. However, cybercriminals have been discovering increasingly clever ways to bypass it.
During an attack on Uber’s IT systems in 2022, the hackers did not use any sophisticated tactics to gain access. Instead, they bombarded an employee with repeated login requests until, out of sheer frustration, the employee approved one.
This type of cyberattack is known as an “MFA fatigue attack” and poses a real risk to organisations, says Anna Collard, SVP Content Strategy and Evangelist at KnowBe4 AFRICA, a cybersecurity training designer.
“MFA fatigue attacks, also known as prompt spamming or authentication bombing, exploit human vulnerability, rather than relying on high-tech hacking methods,” she explains. “These attacks involve sending continuous push notifications to a target who has already provided their username and password, aiming to irritate or confuse them into unwittingly granting the attacker access to their account or system.”
With Uber, the attacker likely bought the contractor’s Uber corporate username and password on the dark web. The attacker then made repeated attempts to log into the victim’s Uber account. Each time, the victim received a request to approve a two-factor login, which blocked access at first. However, eventually, and after the attacker contacted the contractor on WhatsApp claiming they were from Uber IT and that the only way to get rid of the never ending notifications was to accept one, the contractor accepted one request, allowing the attacker to successfully log in.
Previously, cybersecurity experts believed that Multifactor Authentication (MFA) was a foolproof method to protect corporate IT systems from hackers. “Now we’re seeing attackers finding ways around it by bombarding the victim with scores of MFA requests or by tricking them over the phone,” says Collard. This tactic, similar to a swarm of bees overwhelming someone, is a simple yet effective social engineering technique used by hackers. “By bugging you repeatedly until you give in, malicious actors can manipulate users into approving fraudulent access attempts,” says Collard.
How can you prevent it?
The best way to prevent MFA fatigue attacks in organisations is not to use push notifications. “While MFA provides an extra layer of security, it’s not foolproof,” she asserts. “From a cybersecurity perspective, I would recommend that organisations disable push notifications altogether and rather use alternative verification methods.”
An example of a better verification method is number matching. “This involves matching a unique code provided by the authentication app with the code displayed on the screen during the login process,” explains Collard.
A challenge-response method is another effective way of providing additional security. This method asks a user a specific question to verify their identity or to perform a task in response to a challenge. “A challenge-response method is more difficult for hackers to bypass. It can involve mechanisms like biometric authentication, in which users must scan their fingerprints or irises or use facial recognition to gain access to a network.” However, both of the above are not immune against so-called man in the middle or social engineering attacks tricking the users to hand over their OTP or response to the fraudster.
Another effective verification method is FIDO2, an open authentication standard that allows users to log in without using passwords. “You can implement FIDO2 using hardware security keys,” she explains. Typically, USB sticks store the user’s private key, while the public key is stored on the authentication server. As soon as the user enters their username and password, the system requests them to use the hardware key. “It is more resistant to phishing as it works on a challenge-response protocol and doesn’t rely on a one-time PIN that can be intercepted,” she adds.
Mindfulness is key
As with all hacking attempts, it’s crucial that users remain calm and mindful, rather than reacting emotionally. “Stay tuned into your body’s responses when dealing with potential cybersecurity threats, whether they are phishing emails or MFA fatigue attacks,” says Collard. “If something feels strange, like if the situation is putting you under undue pressure, listen to that cue and don’t respond in a knee-jerk fashion. In this way, you’ll keep a straight head and thwart potential data breaches.”
Provided by SyndiGate Media Inc. (Syndigate.info).
News Related
-
, Nov. 28 — One of the most anticipated Android releases for 2023 has been the Google Pixel 8 lineup. The Pixel series is often considered the best of what Android has to offer since it brings the true stock Android experience. The Pixel 8 Pro was globally released on ...
See Details:
Google Pixel 8 Pro Review: Is this the best Android phone of 2023?
-
A blank space or an (NR) indicates no readings received. An (e) indicates that the water level has been estimated. An (w) indicates that the conditions were very windy, resulting in an inaccurate reading. Omatjenne Dam does not have abstraction facilities. The dam contents are according to the latest dam ...
See Details:
Namwater Dam Bulletin on Monday 27 November 2023
-
Dhaka, Nov. 27 — Nobel laureate Dr Muhammad Yunus has been appointed chair of the international advisory board of Moscow’s Financial University (under the government of the Russian Federation). On November 23, he joined a high-level strategic meeting with Prof Stanislav Prokofiev, Rector of the Financial University, and his colleagues. ...
See Details:
Dr Yunus appointed chair of Moscow Financial University's international advisory board
-
In a pivotal encounter at the International Cricket Council (ICC) Twenty20 World Cup Africa Final Monday, the Cricket Cranes faced Nigeria, knowing that a win could significantly boost their chances of securing one of the coveted tickets to the 2024 T20 World Cup in West Indies and the USA.Nigeria won ...
See Details:
Victory over Nigeria puts Uganda on the brink
-
Capture 1 The Bank Ghana (BoG) Monetary Policy Committee (MPC) has maintained the key policy rate at 30 percent, while introducing additional liquidity management measures to address excess liquidity and reinforce the disinflation process. Announcing the committee’s decision on Monday following its 115th meeting, BoG Governor Dr. Ernest Addison said ...
See Details:
BoG holds policy rate at 30%, tightens liquidity measures
-
Renita Holmes has been displaced four times in the past three years by rising rents With sea levels rising around the globe, Miami, in the US state of Florida, is facing an urgent need to adapt. As property investors turn their gaze inland, away from the exclusive low-lying beach area, ...
See Details:
When sea levels rise, so does your rent
-
Picture2 In a groundbreaking moment, Mrs. Adelaide Siaw Agyepong, CEO-American International School, has achieved yet another milestone by being crowned ‘Icon of Inspiration and Impact for the Year 2023’. The crowning achievement took place in Accra, where Mrs. Siaw Agyepong surpassed contemporaries to clinch this prestigious title at the 5th ...
See Details:
American International School CEO honoured as ‘Icon of Inspiration and Impact’
-
Freetown’s streets were almost empty on Sunday after a curfew was imposed Gunmen in Sierra Leone attacked a military barracks and freed hundreds of prisoners in a “co-ordinated and properly planned” attack, the country’s information minister has said. Sierra Leoneans spent Sunday under a nationwide curfew amid disarray in capital ...
See Details:
Sierra Leone prison breaks co-ordinated - minister
-
Freetown’s streets were almost empty on Sunday after a curfew was imposed Gunmen in Sierra Leone attacked a military barracks and freed hundreds of prisoners in a “co-ordinated and properly planned” attack, the country’s information minister has said. Sierra Leoneans spent Sunday under a nationwide curfew amid disarray in capital ...
See Details:
Address the rise of single parenthood
-
Freetown’s streets were almost empty on Sunday after a curfew was imposed Gunmen in Sierra Leone attacked a military barracks and freed hundreds of prisoners in a “co-ordinated and properly planned” attack, the country’s information minister has said. Sierra Leoneans spent Sunday under a nationwide curfew amid disarray in capital ...
See Details:
Hyundai Chief Picked as Auto Industry Leader of the Year
-
Freetown’s streets were almost empty on Sunday after a curfew was imposed Gunmen in Sierra Leone attacked a military barracks and freed hundreds of prisoners in a “co-ordinated and properly planned” attack, the country’s information minister has said. Sierra Leoneans spent Sunday under a nationwide curfew amid disarray in capital ...
See Details:
Unmarried People Under 35 Outnumber Married Ones
-
Freetown’s streets were almost empty on Sunday after a curfew was imposed Gunmen in Sierra Leone attacked a military barracks and freed hundreds of prisoners in a “co-ordinated and properly planned” attack, the country’s information minister has said. Sierra Leoneans spent Sunday under a nationwide curfew amid disarray in capital ...
See Details:
European interior ministers in Hungary to discuss migration
-
Freetown’s streets were almost empty on Sunday after a curfew was imposed Gunmen in Sierra Leone attacked a military barracks and freed hundreds of prisoners in a “co-ordinated and properly planned” attack, the country’s information minister has said. Sierra Leoneans spent Sunday under a nationwide curfew amid disarray in capital ...
See Details:
Japan on the watch for unlicensed taxis around Narita airport amid foreign tourism spike
-
Freetown’s streets were almost empty on Sunday after a curfew was imposed Gunmen in Sierra Leone attacked a military barracks and freed hundreds of prisoners in a “co-ordinated and properly planned” attack, the country’s information minister has said. Sierra Leoneans spent Sunday under a nationwide curfew amid disarray in capital ...
See Details:
ECOWAS to send high-powered delegation on solidarity visit to Sierra Leone
OTHER NEWS
Despite doing education at the university, Mellon Kenyangi, also known as Mama Bear, did not think of going to class, and teaching students was her dream job.“Since it was not ...
Read more »
213 Sri Lanka Cricket’s Chairman of Selectors, Pramodya Wickramasinghe reported to the Sports Ministry’s Special Investigation Unit( SMSIU) for the Prevention of Sports Offences yesterday for the second day. He ...
Read more »
137 Malindu Dairy (Pvt) Ltd., a leading food production company in Sri Lanka, won the Silver Award in the medium-scale dairy and associated products category at the Industrial Excellence Awards ...
Read more »
Africans Urged to Invest Among themselves, Explore Investment Opportunities in Continent Addis Ababa, November 27/2023(ENA)-The Embassy of Angola in Ethiopia has organized lecture on the “Foreign Investment Opportunities in Angola ...
Read more »
144 The dynamic front row player Mohan Wimalaratne will lead the Police Sports Club Rugby team at the upcoming Nippon Paint Sri Lanka Rugby Major League XV-a-side Rugby Tournament scheduled ...
Read more »
Dozens of people living with disabilities from New Hope Inclusive in Entumbane, Bulawayo on Saturday last week received an early Christmas gift in the form of groceries. The groceries were ...
Read more »
The East African Community (EAC) Summit of Heads of State has admitted the Federal Republic of Somalia to the regional bloc, making it its 8th member country. The decision was ...
Read more »