Multi-factor authentication (MFA) fatigue is a relatively new kind of threat that has garnered increased attention lately, making headlines as the main technique used in several high-profile attacks and breaches.
Imagine being constantly bombarded with authentication requests to your mobile device, each vying for your attention and approval. For many, the reaction might be to simply approve the request to make the notifications stop. This, unfortunately, is exactly what certain threat actors bank on.
We’ll delve into the world of MFA fatigue attacks, shedding light on its mechanisms, manifestations, and most importantly, how you can safeguard against it.
In this blog, we’ll cover:
Multi-factor authentication (MFA) is a security measure that adds an extra layer of protection to your online accounts. It requires users to provide two or more verification factors, such as a password, fingerprint, or a unique code sent to their mobile device. While MFA is an effective method to enhance security, it can also lead to a phenomenon known as MFA fatigue.
MFA fatigue, also known as MFA bombing, refers to the weariness or frustration users may feel due to repeatedly going through multiple steps or processes to authenticate themselves when accessing various services or systems.
Attackers would send an endless stream of MFA push requests to the account holder’s chosen authentication devices, aiming to get the target people overwhelmed and finally get them to accidentally click the “Approve” button or simply accept the MFA request to end the flood of notifications sent to their devices.
These attacks rely on the users to approve a simple voice, SMS or click in an email or push notification that doesn’t require the users to have context of the session they are authenticating.
According to research findings provided by Azur, MFA fatigue attacks are on the rise, and this is expected to continue as basic multifactor authentication coverage increases.
MFA fatigue can have a significant impact on an organisation's security. When users experience fatigue, they may resort to using weaker authentication methods or disabling MFA altogether, leaving their accounts vulnerable to attacks.
additionally, MFA fatigue can negatively affect productivity and user experience. It can slow down the login process and create frustration, especially in situations where quick access is required.
Any user of MFA can be a target, especially if they aren't well-acquainted with the MFA attacks.
However, entities that don't have clear and secure communication channels for support-related queries and organisations that don't regularly update and educate their users about security best practices suffer a higher risk.
Fake MFA prompts look exactly like genuine ones. Victims would receive emails, messages or phone calls urging actions relevant to accepting an MFA request.
An international extortion-focused hacker group, Lapsus$, highlighted the weaknesses of certain MFA options, specifically push approvals. One of their members has revealed the method their hackers utilise to steal notification approvals. Once they have the victim’s credentials, they would simply spam users with MFA prompts until they get approved.
A member of Lapsus$ wrote on the group’s official Telegram chat channel, saying
“Call the employee 100 times at 1 a.m. while he is trying to sleep, and he will more than likely accept it. Once the employee accepts the initial call, you can access the MFA enrollment portal and enrol another device.”
Source: LAPSUS$ Telegram
The MFA code or approval request will usually come through some type of “push” message. Users can receive it in a few ways:
Always keep in mind that human is often the weakest link in security. To overcome MFA fatigue attacks and maintain strong security, we can consider the following methods.
Be vigilant about evolving threats and stay updated on best practices in MFA and cybersecurity. As attackers adapt, organisations must continually refine their defences and user training.
Check out our new course with engaging animation explaining what MFA fatigue attacks are. We are confident to help your end users defeat these attacks by increasing their awareness through continuous education. Alternatively, try our 14-day free trial to experience how we can help you strengthen your cybersecurity defence.