In the contemporary digital world, where the world is changing by the second, businesses are looking to adopt novel ways to protect their vital data and themselves from hackers and the like. Adopting multi-factor authentication at the time was seen as a plus by businesses until push-bombing became an issue.
Right now, it has become a concern and is looking like the next major thing for businesses to hold meetings over. From C-level employees down to departmental and IT staff, everyone is getting increasingly worried about the daily increasing threats and risks that are coming up with this new type of attack.
To show how serious this issue is, Microsoft reports that MFA push-bombing attempts rose by nearly 80% in less than a year – between December 2021 and August 2022. Many hackers are taking advantage of human error for this, and companies are suffering.
So, how do we tackle push-bombing? Before answering this question, let’s define push-bombing.
Push-bombing is a common occurrence by hackers aimed at businesses and companies that use MFA to safeguard their data. MFA refers to the secure login process that aims at confirming the identity of the actor behind the login by using two or more devices to verify the “check.” This is just one of the numerous ways to verify user identity and is highly preferred given its simple process and UX benefits, of course.
Push-bombing is an approach by hackers where the malicious actor utilizes a bot or script to trigger several login attempts with illegally-procured login details and uses it to start a chain of multiple notifications to the user’s personal device repeatedly.
Below is a more explicit description:
It is also common for such fraudulent attackers to come up with a narrative of being an IT admin from the same company which the innocent user works for, in a bid to persuade them to accept their login attempt.
In cybersecurity, the best way to repel an attack is to offer a lot of resistance in quantity and quality. Here are some ways to keep your devices safe from push-bombing:
Fully passwordless MFA policies that meet FIDO standards fit the definition of phishing resistance approved by CISA. While some solution providers offer some level of FIDO authentication and use vulnerable approaches for contingencies as hackers do not waste time trying to take advantage. However, systems like these cannot be termed fully passwordless MFA.
Fully passwordless MFA that employ QR code scanning, for example, provide the most resilient protection against push-bombing. This is because the attack vector (passwords) is eliminated.
If your company is in the business of login details comprising usernames and passwords, ensure your employees use password vaults and managers. A better option is a full Privileged Authentication Management solution (PAM) for highly secure and sensitive logins. There should be constant reviews and checks of this process, and you can get an external managed IT professional to take a look too.
If you suspect any credentials have been compromised, engage a password reset. This will help you avoid push-bombing in the future. While arbitrary password changing is not the best thing to do, forcing a password change or reset is an excellent way to limit how much time compromised credentials will be used during push-bombing.
It is essential to constantly review company MFA configurations. This is to check if basic access patterns are still as secure and sensible as possible. It is not uncommon to reconfigure the best MFA solutions as it will reduce access with limited verification.
You should also apply smart password best practices. Do not allow your staff to use the same login details for several services except when it is of the utmost importance. Hence, if a compromise occurs, the potential push-bombing attack surface is reduced.
If you are looking to increase your business’s cybersecurity levels, especially against push-bombing, then Digital Crisis is here for you. We provide managed IT services, top-notch IT cybersecurity, and 24/7 IT support. Contact us if you need any of these services.
