Advice from business leaders and industry experts
Cyber Aware | 14 November 2022
Imagine you’re driving to work and you get a notification on your phone saying that someone is trying to log into one of your Square or PayPal accounts.
If your attention is elsewhere, there’s a high chance you might click “Yes” or “Approve” under the impression that one of your colleagues is trying to log in.
But what if the login notification isn’t coming from a coworker, but from a hacker trying to find a backdoor into your business?
This is an example of multi-factor authentication prompt bombing – a new type of attack that uses multi-factor authentication to break through your business’s security.
If you’ve ever looked into cybersecurity for your business, you’re probably already aware of multi-factor authentication (otherwise known as MFA).
If not, it’s a simple safety measure you can use on your account logins to add an extra layer of protection against hackers and cyber criminals.
It typically works by sending a one-time code to your phone or chosen MFA app when you try to log into an account, which is then used alongside your password to log in.
MFA is capable of preventing 99.9 per cent of account compromise attacks according to Microsoft – the problem is that cyber criminals have found ways to use MFA in a new type of cyber attack called MFA prompt bombing.
MFA prompt bombing attacks use deception and trickery to fool users into accepting an MFA request, which hackers can then use to illegitimately log into your workplace accounts, such as Google, Microsoft Teams or other apps.
The new MFA prompt bombing attack is highly dangerous for business owners, as it targets you and your workers in ways that you’d least expect.
MFA prompt bombing is a cyber attack that leverages multi-factor authentication, such as SMS, email and MFA apps, to trick you into giving a hacker access to your account.
To perform the attack, a hacker will repeatedly send MFA requests to your device with the hope of eventually tricking you into approving one.
The reason that MFA prompt bombing is so strong is most users think the MFA request is legitimate, and approve it without a second thought.
For example, you might get a notification on your phone saying that someone is trying to log in to your Google account.
Google will ask you “Yes” or “No” to the sign-in request, so if a hacker is trying to break into your account, you have the chance to stop them in their tracks by clicking “No”.
However, as most business owners know, it can be difficult to give your full attention to every alert that pops up on your phone.
If you’re in the middle of some important accounting work, or are simply getting the kids ready for school, there’s a chance you’ll just press “Yes” under the impression that the login request is coming from a colleague.
The problem is that after you approve just one fake MFA request, the hacker is already in the account and able to, at a minimum, access your sensitive business data.
In the worst-case scenario, they can use the account to unleash further damage, such as a business email compromise attack.
Prompt bombing attacks can happen at any time of the day, and work best when they catch you off guard.
Hackers will often send more than just one MFA request – in fact, they’ll send dozens upon dozens with the hope you eventually click just one.
As such, they can come through at the most inopportune of times – whether you’re rushing to the office or have just sat down in an important meeting. They can even come through while you’re sleeping, piling up and hoping to catch you off guard before the day has even started.
Thankfully, there are a number of requirements the hacker needs before they can try to prompt bomb your accounts.
Firstly, the hacker needs to have already taken your username and password from a separate incident, such as phishing or keylogging.
Furthermore, this particular method of attack is reliant on one-time MFA links or “prompts” that approve a login request upon being tapped. Its success depends on the victim eventually clicking a link either by accident or out of sheer confusion and frustration.
Unfortunately, if the user clicks the MFA link just once during a prompt bombing attack, the cyber criminals’ login attempts are authenticated and they can then gain full access to the compromised account.
MFA prompt bombing is more common than you might think and has been used for some of the most well-known data breaches over the last year. The major software company, SolarWinds, suffered an attack on its 18,000 customers at the hands of a Russian espionage group using MFA prompt bombing.
And in March 2022, Microsoft had a massive source-code leak from hackers using the same technique. While prompt bombing may seem like a simple technique, it’s highly effective even against some of the most advanced tech companies of today.
The group behind this particular hack, Lapsus$, has been quoted as saying, “No limit is placed on the amount of calls that can be made. Call the employee 100 times at 1 am while he is trying to sleep, and he will more than likely accept it. Once the employee accepts the initial call, you can access the MFA enrollment portal and enroll another device.”
Small business owners may find themselves at increased risk of prompt bombing, as employees often have less knowledge of cyber safety.
In conclusion, MFA prompt bombing is an alarmingly popular attack method that all business owners should be aware of. Discuss this attack type with your colleagues, and take the above tips into consideration every time you receive an MFA request.