How do attackers hack MFA (Multi-factor Authentication)? 

How do attackers hack MFA (Multi-factor Authentication)? 

One of the simple ways to add a layer of security is by enabling Multi-factor Authentication (MFA). They serve as a useful measure to prevent password attacks since passwords play a critical role in identity-related breaches.   

Why MFA is so effective?  

Security experts recommend enabling MFA because it seeks multiple authorizations before granting user access. It is effective in preventing account compromise attempts. MFAs are part of cybersecurity hygiene practices today and have become a reliable means to reduce the possibility of unauthorized access to an account.  

According to Microsoft, Multifactor Authentication can block over 99.99% of account compromise attacks. Since MFAs have become quite a popular security measure, attackers have found a way around it. 

What is an MFA bypass? 

In an MFA bypass the attacker attempts to avoid and circumvent MFA to gain access to the user’s account. MFA bypass attacks have become more frequent in modern-day attacks. But let us understand how MFA verifies identity. 

How does MFA verify identity? 

MFA uses any two of these aspects to verify an identity.  

• A Knowledge factor – all MFAs need a PIN or an OTP or require answering a security question. It provides security since it requires something only you would know and no one else would.  
• A Possession factor – The second aspect that it relies on is something that only you would have. It can be an endpoint, a phone to receive push notifications, or a security key. 
• An inheritance factor – Lastly it requires a unique part of your identity such as biometrics that can include your fingerprints, your retina scans, or your voice.  

An attacker exploits weaknesses in these aspects to carry out an MFA attack. Let us explore the different ways through which attackers carry out MFA attacks. 

How do attackers hack MFA? 

MFA Fatigue 

It is also known as MFA Bombing/ MFA Spamming. It is one of the sophisticated attacks that rely on social engineering attacks. In this, an attacker collects information and credentials of their victims through phishing or data breaches.  It is why the attack often precedes phishing.  

Once the attacker gains information on his targets, he sends constant push notifications to their phone/device.  When the victim gets overwhelmed by the notifications and clicks ‘yes’, he gives unauthorized access to an account.  

The attacker can pose as a technical support executive and request a notification, making it seem like a regular maintenance procedure. MFA Fatigue attack was a method used by attackers of the Lapsus$ group to pose as an authorized person to lure their victim into authenticating credentials on WhatsApp. 

Token Theft 

It is one of the most commonly used techniques by Advanced Persistent Threat groups. In this, the attacker gains access to their victim’s system by manipulating cookies stored in the browser. Attackers steal cookies in session codes used by web browsers to make re-authentication easy for their users. Attackers place their own session cookies to make browsers believe they are genuine users gaining authentication over MFA. 

Machine-in-the-middle 

It is a phishing attack where the attacker tricks users into clicking a malicious link that gives access to their machines, circumventing MFAs. It redirects the user to a malicious proxy server. The attacker intercepts the network traffic between the victim’s system and the actual webserver stealing the MFA session cookies and web session for their victim that contains credentials. It becomes a useful tool to carry out token theft attacks. 

Social engineering 

Attackers may use social engineering solely to pose as a vendor, emailing the employee to request a verification code in the name of account confirmation. They send a malicious link with the email requesting their victim to access the link to confirm their account. 

SIM Hacking  

Through unauthorized access to their victim’s SIM card by using SIM swapping, SIM cloning, and SIM jacking, they gain complete control of their victim’s phone. They use the compromised phone to receive SMS-based OTPs, using the authentication in a hacking attempt. 

Brute forcing of One Time Passwords 

MFAs rely on temporary one-time passwords that are weak and require four characters or less. Attackers use brute force attacks to crack OTPs and provide authentication during hacking attempts. 

Through the exploitation of generated tokens 

Authentication service providers like Microsoft Authenticator and Google Authenticator give users a list of manual authentication codes so they don’t get locked out. These codes are often stored insecurely by users. Attackers leverage this information to get hold of insecurely saved codes to access to the victim’s account, bypassing MFAs.   

How to prevent MFA attacks? 

Now you must be wondering how to be safe from MFA attacks. Here are some ways you can reduce the possibility of becoming a victim of MFA attacks: 

Set limits on push notifications 

• Disable push notifications as an authentication method and enable locking of accounts on too many MFA attempts. It can reduce the possibility of MFA Fatigue attack significantly.  

Enable number matching 

• By enabling number matching, every time a user tries to sign in, they will be prompted with a code on their browser that they must input on their mobile device. It will require third party trying to sign in to contact the user to input code in the authenticator application.  

Raise awareness on MFA attacks:  

• Chances are, there are many people who aren’t aware of MFA attacks. Attackers leverage this lack of knowledge to find weaknesses in security. Therefore, awareness becomes a fundamental defense pillar against MFA attacks.

Discover how attacker use different techniques to hack passwords