New Multi-Factor Authentication Prompt “Bombing” Attacks Give Access to Laptops, VPNs, and More
While multi-factor authentication (MFA) significantly reduces an organization’s threat surface by making the stealing of credentials much harder, a new attack takes advantage of phone calls as the second factor.
Whenever cybercriminals can successfully leverage the victim themselves as part of an attack, they will. And that appears to be the case in a new attack by cybercriminal group Lapsus$. In this new attack, first detailed by Wired, Lapsus$ has taken advantage of various platform’s MFA implementation that uses either a phone call or pushing a button on the screen of their mobile phone.
The attack method is rather simple – call the victim employee a multitude of times at 1am when they’re sleeping, and – according to Lapsus$ on their official Telegram channel – [the victim employee] “will more than likely accept it. Once the employee accepts the initial call, you can access the MFA enrollment portal and enroll another device.”
According to reports, Lapsus$ has successfully used MFA prompt bombing against Microsoft to gain access to the internal Microsoft network via an employee’s VPN.
Users of MFA need to be made aware of these types of techniques via Security Awareness Training to group this kind of unexpected prompting in with phishing emails, social engineering scams on social media, etc. – anytime they interact with something that provides access that they were not expecting to see should be considered suspicious.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 23 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW