MFA fatigue attack
A technique of sending the victim a burst of authentication approval requests until the victim accepts one out of weariness or by mistake; it bypasses multi-factor authentication without breaking it.
Push-notification multi-factor authentication works like this: the user enters a password, then receives an approval request on the phone. If the attacker has obtained the password, by phishing or on a stolen-data market, the second factor is still missing. The fatigue attack consists of triggering dozens of requests, sometimes in the middle of the night, until the victim taps approve to stop the alerts, or out of confusion. It is often combined with a call or message impersonating IT support, asking the user to accept the notification to fix a problem. Several highly publicized intrusions in 2022 at large technology companies started this way. The countermeasure is technical and well known: require the user to type a code shown on screen rather than approve with a single tap, limit the number of requests, display the login location, or move to phishing-resistant methods, hardware keys and passkeys. For the underwriter, it is a lesson about questionnaires: ticking the multi-factor authentication box says nothing about its strength. Recent questionnaires therefore ask for the method used, not merely its presence.
Textbook case: an accountant receives thirty approval notifications in an hour, then a message from a supposed technician asking to approve one to stop the problem. He complies; the attacker gets into his mailbox. At renewal, the insurer requires number matching for all approvals.
MFA fatigue, push bombing, MFA bombing, prompt bombing
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.