In the ever-evolving landscape of cybersecurity, Multi-Factor Authentication (MFA) has emerged as a robust defense mechanism, adding layers of security beyond traditional passwords. However, a deceptive tactic known as “push-bombing” is undermining this very safeguard, posing significant risks to individuals and organisations alike.
Understanding Push-bombing, also referred to as MFA fatigue or MFA spamming, is a social engineering attack that targets the human element of security systems. Attackers initiate this method by obtaining a user’s login credentials, often through phishing or data breaches. Subsequently, they attempt to access the account, triggering a barrage of authentication prompts sent to the user’s device. The relentless stream of notifications aims to confuse or frustrate the user into inadvertently approving one, thereby granting unauthorised access to the attacker.
Real-World Implications
The consequences of successful push-bombing attacks are far-reaching. Once inside a system, attackers can exfiltrate sensitive data, deploy malware, or move laterally within networks to compromise additional systems. Such breaches not only result in financial losses but also damage an organisation’s reputation and can lead to regulatory penalties.
Several high-profile organisations have fallen victim to push-bombing attacks. In September 2022, Uber experienced a breach when attackers used stolen credentials to flood an employee with MFA requests. Overwhelmed, the employee eventually approved one, granting the attackers access to internal systems. Similarly, in May 2022, Cisco faced a breach where attackers combined MFA fatigue with voice phishing to compromise an employee’s account. These incidents underscore the effectiveness of push-bombing tactics and the need for heightened vigilance.
Mitigation Strategies
To combat push-bombing, a multifaceted approach is essential:
• User Education: Informing users about the nature of push-bombing attacks is crucial. Training should emphasise the importance of scrutinising authentication prompts and reporting suspicious activity promptly.
• Phishing-Resistant MFA: Transitioning to authentication methods that do not rely on push notifications, such as hardware security keys or biometric verification, can eliminate the risk associated with push-bombing.
• Adaptive Authentication: Implementing systems that assess contextual factors, such as login location, device type, and time of access, can help identify and block anomalous login attempts.
• Rate Limiting: Configuring MFA systems to limit the number of authentication attempts within a specific timeframe can prevent attackers from overwhelming users with prompts.
While MFA remains a cornerstone of cybersecurity, awareness of its potential vulnerabilities, like push-bombing, is vital. By adopting advanced authentication methods, educating users, and implementing intelligent security measures, organisations can fortify their defenses against this subtle yet potent threat.
