Multi-factor Authentication Prompt Bombing, heard of it?
This is one of the newest techniques used to trick account owners into granting access to their account to a hacker. Given the news recently, cyber security has never been more important to businesses than it is right now. Unfortunately, small businesses are at most risk due to their lack of cyber security knowledge and mistaking a log in attempt from one of their employees. So how do we outsmart the hackers?
How to avoid falling victim to yet another cyber security attack.
Firstly, it is important to understand why we use Multi-factor Authentication (also known as MFA). Simply put, MFA is an extra layer of protection that you can add to your account to secure it from unwanted visitors. It typically works by sending a one-time code and using this alongside your password to log in. Essentially a security measure that requires two or more forms of identification to grant access – rather than relying just on a password alone.
So how are the hackers gaining this information when we have a multi-factor authentication in place? MFA Prompt Bombing attacks are performed by repeatedly sending you texts, SMS’s and emails, in the attempt to deceive you into believing this is a legitimate log in attempt. The hackers will only need one approval to a fake MFA request to have full access to your account and at a minimum access your sensitive business information and data.
MFA prompt bombing attacks can happen at any time of day – usually at the most inopportune times. Before these attacks can take place, hackers will have had to have gained your username and password first. This usually occurs from separate incidents such as phishing or keylogging. Unfortunately, MFA prompt bombing is becoming more popular and is the same practice that has been used for some of the most well-known data breaches throughout this year.
Here are 5 ways you can prevent an MFA prompt bombing attack against your business.
1: If you or an employee aren’t trying to log in,
ignore these requests for access.
2: Change your password. Again, if you aren’t trying to log in, it’s safe to assume your password has been compromised.
3: Check your location settings. If your app allows you to restrict your log in location, this can stop login attempts from offshore or unapproved locations.
4: Change Multi-factor authentication methods. By having a code-based MFA, the hackers will not be able to log in without you sending them the MFA code directly. One-time codes are often much safer than linked-based requests.
5: Lastly, discuss this type of attack with your business partners and employees. Be alert and act on any suspicious MFA requests.
We can help!
If you would like to learn more call 1300 330 196 (Option 0) and speak with Natalie or Will to find out how we can protect your business!
Call us on 1300 330 196 (Option 0)
We can help!
If you would like to learn more call 1300 330 196 (Option 0) and speak with Natalie or Will to find out how we can protect your business!