Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
MFA Fatigue seems to be hackers` favorite tool this fall, as we have lately witnessed an increase in numbers of this kind of cyber-attack. We are now at the point where it seems that an MFA Fatigue attack can happen to anyone. If you think that being a giant company with a strong IT security department guarantees your safety, think again. Because so did Uber, for example, until the last 6 weeks, when they were hacked, with lots of their most sensitive data exposed.
How Does MFA Fatigue Work?
A multi-factor authentication (MFA) strategy is supposed to secure data and applications, as it requires the user to submit a combination of two or more credentials to be able to log in.
Now what the cybercriminal does is spam the user with MFA prompts until he gives up and accepts one. Being distracted or overwhelmed by the number of notifications, the victim sometimes mistakes them as normal authentication requests. And hackers are always very prompt in taking advantage of human errors caused by a lack of training and cyber education. Once they`ve obtained the victim`s credentials, they gain access to the internal system and a variety of potentially sensitive data.
Why Is It Hard to Recognize a Fraudulent Notification?
The average user knows little or nothing about the latest cybersecurity threats, so he or she can easily become a victim of cyber attackers. The problem is most people are not familiar enough with this kind of attack and they can`t even imagine that approving one notification of many opens the gate for hackers.
It happened to an Uber employee last September. After being continuously bombed with authenticating notifications, he got a message on WhatsApp that appeared to be from one of his colleagues from the IT department. The message requested his credentials and the exhausted employee, wanting to finally move forward with his work, just gave them away. The attack was supposedly performed by the Lapsus$ hacking group and resulted in a serious cybersecurity breach for the ride-sharing company.
How Can MFA Fatigue Attacks Be Avoided?
Your organization`s IT security department is of vital importance, but you should also look for up-to-date, modern cybersecurity solutions.
Limiting the number of MFA requests a user can receive is also important. After a certain number of authentication notifications, the account should be locked and signalized to the domain administrator.
Also, end-user education is a powerful tool against cyberattacks. Making your users aware of the danger and how to avoid becoming a victim of cybercriminals will definitely pay off at some point.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.
