Many consider MFA (multi-factor authentication) as one of the critical security defenses against malicious cyberattacks, and rightly so. Even a large organization like Microsoft claims that MFA enables users to block 99.9 percent of automated attacks. Also, it reduces the risk of identity compromise over passwords. For this reason, we have seen that people across the board have begun to embrace MFA significantly in recent years. We witnessed a wide adoption of multi-factor authentication spanning from social media profiles to corporate accounts.
The deployment of MFA suggests you need to have more than one authentication factor getting identified as a user. So, even if you end up compromising one aspect, you still have a second or third token between cybercriminals and your data. Nevertheless, it is essential to understand that there is no silver bullet when it comes to cyberspace. Though multi-factor authentication proves helpful, cybercriminals yet find techniques to bypass MFA. Therefore, the belief that you are 100% safe because of multi-factor authentication is now over.
Now, let us discuss some frequently adopted techniques cyber-attackers leverage to bypass MFA.
Disabling Multi-Factor Authentication
Disabling or weakening an organization’s ability to enforce multi-factor authentication is one of the notorious techniques cybercriminals leverage to bypass MFA. They perform it by altering a configuration, such as modifying trusted IP configurations. As a result, an attacker can connect from their home base. Meanwhile, they do not need an additional layer of authentication.
Post-MFA Authentication Attacks
Another technique prevailing in cyberspace to bypass MFA is post-MFA authentication attacks. In this technique, an attacker targets browser cookies. The idea is to steal client-side session cookies that reside on the browser of the end-user. Post-authentication leads to the given session cookies on the browser. For instance, users obtain session cookies when they sign into Gmail with their credentials and MFA token. Their browser stores the cookies encrypted in itself.
As a result, users do not require logging back to Gmail repeatedly whenever they close their browser. Every request they make to Gmail subdomains carries the stored cookies. Furthermore, most MFA tools offer a default time frame of 30 days before requiring re-authentication. Subsequently, it provides the attacker with sufficient opportunity to set up persistent access.
Recovery Code Attacks
Many companies leverage MFA solutions that carry backup authentication methods that are comparatively less secure than their primary authentication methods. In this regard, consider an example where a multi-factor authentication solution provides a backup plan such as a code sent via email. In this case, however, a hacker has access to the email account of the legitimate user. It is easy to imagine how convenient it is for a hacker is to bypass the primary authentication. Moreover, it then helps them make inroads into the legitimate user’s account.
Exploiting Architectural Flaws
Several organizations tempt to install single sign-on (SSO) with multi-factor authentication to reduce the risk linked with credential theft. Suppose an alternative website of a similar SSO framework does not involve MFA. In that case, attackers could sign into that website to bypass MFA. Consider an organization that wants to secure its VPN and uses a third-party MFA provider for this reason. In this scenario, remote users can use SSO to access different cloud services when connected to the VPN. Nonetheless, remote users may only have to use domain credentials to access any cloud service. It is the case after they logged in from a trusted IP within the VPN range.
Consequently, it shows a major architectural flaw. The reason is that it translates that multi-factor authentication applies only to infrastructure-based access. On the other side, it does not work on individual user identities to access crucial assets. Hence, a hacker merely must compromise a user’s workstation and access a soft token application present on the machine. Afterward, they can comfortably sign into the VPN and switch out users through any single-user password. Later, a hacker can access even the email of the CEO or influential cloud consoles.
Conclusion
It causes concern that cybercriminals have begun to find ways to bypass MFA. However, it requires to go great lengths to circumvent multi-factor authentications. Luckily, here we may bring to your notice that it is not all pessimism. In any event, you can assess and stop attacks through MFA bypass before they turn into breaches. For organizations wondering to strengthen their cybersecurity game, phishing attack simulation can prove effective.
References
Top five techniques cybercriminals leverage to surpass MFA
New attack techniques to bypass multi-factor authentication
Ways to bypass MFA leveraged by cybercriminals
Discover some MFA bypass techniques
