How hackers are circumventing multi-factor authentication - and organizations should upgrade now
by Tina Siering
Why multi-factor authentication can't provide 100 percent protection
The numbers are frightening. There are currently around 24.6 billion stolen login pairs - the combination of login name and password - for sale on the darknet. Cyber criminals can easily take advantage of the leaked data and abuse it for their own purposes. The Digital Shadows Research Team's "Account Takeover" study shows a dramatic 64% increase in stolen credentials subsequently offered for sale compared to 2020. The use of weak credentials poses a significant risk in this regard; they are almost playfully exploited by cyber attackers. With brute force attacks, the automated, simple trying out of password combinations or password keys, simple passwords without MFA can be cracked relatively easily. Modern high-performance computers speed up the process. The result: industrial espionage, identity theft, extortion with ransomware.
Recently, many companies and organizations have upgraded their security systems and made multi-factor authentication (MFA) mandatory. This involves implementing one (or more) additional authentication measure(s) in addition to entering a username and password, such as sending a one-time PIN to the smartphone or through the use of authenticator apps. MFA significantly increases the level of access security compared to using user and password alone. However, even MFA is not an "absolutely reliable seat belt" and can provide a sense of deceptive security. Cybercriminals have now developed a variety of tactics to circumvent the controls of the security mechanism and render the MFA ineffective as a result.
Seven tactics criminals use to bypass multi-factor authentication
Tactic 1: SIM Swapping - Your SIM is now my SIM!
The SIM card in your smartphone or tablet is a personal object that exists only once? Wrong thinking. In SIM swapping attacks, cybercriminals impersonate your mobile carrier as a customer and order a new SIM card in your name via phone or online customer portal. The new SIM card is then linked to your mobile number - and the attackers can effortlessly receive your SMS or make calls. This gives the cybercriminals access to all online services associated with your phone number, and they can reset passwords or verify themselves.
Tactic 2: Phishing - Leveraging MFA in an automated way.
Multi-factor authentication reliably separates passwords and one-time passwords (OTP). Actually. Using phishing techniques, cybercriminals are now able to steal passwords and one-time passwords in combination. For this, cybercriminals rely on two-pronged attacks. While passwords are being stolen on a fake site, they are simultaneously entered on the real website for the login process. However, the system only works in real time via interaction between the victim and the attacker. This highly labor-intensive method is often supported by automated phishing toolkits.
Tactic 3: Man-in-the-middle attacks - watch out, hacker is reading along
For man-in-the-middle attacks, cybercriminals hook into two parties' communications. While each party thinks they are communicating with the "correct" counterpart, the hacker in the middle taps into the information being sent. In this form of cyberattack, the hacker gains complete control over the traffic. The info can include login credentials as well as account information or your credit card number. Man-in-the-middle attacks become particularly dangerous when combined with other methods.
Tactic 4: Robocalls - Data transfer on call
Robocalls, or robotic calls, are automated phone calls made through computer software. By using constantly revised templates, robocalls specifically mimic how employees or staff of banks or insurance companies, for example, sound in person. Potential victims are persuaded to provide their data, such as login, account, or credit card information, in this fake-confidential "conversation environment." In hacker circles, the technique has a success rate of over 80 percent.
Tactic 5: SMS OTP attack - Widely used and therefore so vulnerable
The use of one-time passwords (OTP) sent via SMS is still prevalent in the realm of multi-step authentication, although this type of two-factor authentication should be avoided. What looked like a solid and strong authentication process when it was first introduced is now easily bypassed by mobile authentication apps (the far more secure method of transmission). Online banking in particular switched from mobile TANs to app-based solutions a while ago. This is because, unfavorably, one-time passwords via SMS are particularly susceptible to successful cyberattacks that quite specifically exploit existing vulnerabilities in mobile networks. In addition, there are problems with reliability: SMS messages can sometimes take a long time to be transmitted and can even disappear (e.g., in regions with poorly developed mobile networks). The sender then never knows for sure whether a message has been delivered.
Tactic 6: Falsify IT help desks - research before the attack
Hackers also want to use their own resources as efficiently as possible. Before cybercriminals launch an attack on a company, they usually test out how securely the company's MFA is set up. In this social engineering method, cybercriminals impersonate employees themselves to find out the procedure for a password reset. In parallel, login credentials are tapped. At the end of the day, the cyber attackers have all the information needed for a password reset and subsequent takeover of the victim's access.
Tactic 7: Accidental Push Accept
Accidental Push Accepts appear to be one of the trends among cybercriminals in 2022. Push messages to the smartphone are used by numerous companies around the world as a simple method of authentication. The user receives a "pushed" notification on his smartphone after entering his password and only has to confirm it by touch - and access is authorized. With Accidental Push Accepts, hackers shamelessly exploit the possibility of push messages: They are already in possession of the valid credentials and only need confirmation via the push message. The victim is then "bombarded" with notifications without ceasing until he accidentally or frustratedly agrees. A lot really helps in this case, because inattentive or stressed people in particular would rather click away the annoying message than pay attention to its content.
How can companies and organizations upgrade?
One thing is certain: multi-factor authentication alone is not enough to secure access to confidential data. There are currently too many "gateways" that can be exploited by cybercriminals. Companies and organizations should therefore expand existing IT security measures to include a system for early attacker detection: to be able to recognize suspicious communications in the network immediately and thus ward off potential attacks in good time. Allgeier secion offers such a solution with its Active Cyber Defense Service (ACD).
Conclusion
Multi-factor authentication is better than the sole combination of login name and password, that much is clear. However, even solid multi-factor authentication doesn't provide 100 percent protection from hackers, because they know exactly where MFA vulnerabilities lie - and how to exploit them.
Companies and organizations that want to successfully fend off cyber attacks at an early stage have recognized how important functional early attack detection therefore is: Active Cyber Defense (ACD) from Allgeier secion offers such an early warning system. ACD is a "managed detection and response service" (MDR) that proactively and continuously analyzes the corporate network for anomalies. If systems are compromised, Allgeier secion's ACD team takes immediate action, informs the customer's IT managers and provides concrete recommendations for action to avert potential damage from the attackers. The 24/7 Managed Service can be booked at a fixed monthly price and, as a lean but effective early warning system, helps to effectively secure the corporate network so that costly reactive measures can be avoided in the event of an attack.
Need help upgrading your IT security for 2022? Contact us!
Related articles
For several days now, there has been a strong accumulation of successful compromises by the "QakBot" malware (also known as "QBot" and "QuackBot") worldwide. We have also already identified successful attacks as part of our ACD monitoring. After infection, criminals can gain access to online banking accounts, leak user data, and reload further malware. As one measure to mitigate the risk, we urgently recommend adjustments to the Group Policy Objects (GPO).
Cybercriminals are true masters at constantly adapting their attack mechanisms to effective IT security measures. New tools and iterative changes to existing malware are used to mercilessly exploit security vulnerabilities. Among the numerous threats, ransomware stands out as one of the biggest. More and more companies have to face extortion Trojans. A completely new threat called LockFile now relies on intermittent encryption. LockFile not only encrypts much faster than previous ransomware, but also bypasses security solutions that work reliably. This article shows why criminals are increasingly relying on intermittent encryption and how companies should react to the new threat.
Read more … New ransomware trend: Why criminals increasingly rely on intermittent encryption
Due to the war in Ukraine, secion provides an assessment of the threat situation for companies and examines the question of whether increased Russian attacks on companies in Germany, Austria and Switzerland can be identified. There is currently no evidence of an acute increase in the threat posed by Russian state actors in Western Europe, but there is increased public awareness of these cyberattacks. In addition, "third-party actors" are creating a new dynamic.