<strong>5 Ways to Protect Your Devices against Push-Bombing</strong>

In the contemporary digital world, where the world is changing by the second, businesses are looking to adopt novel ways to protect their vital data and themselves from hackers and the like. Adopting multi-factor authentication at the time was seen as a plus by businesses until push-bombing became an issue.

Right now, it has become a concern and is looking like the next major thing for businesses to hold meetings over. From C-level employees down to departmental and IT staff, everyone is getting increasingly worried about the daily increasing threats and risks that are coming up with this new type of attack.

To show how serious this issue is, Microsoft reports that MFA push-bombing attempts rose by nearly 80% in less than a year – between December 2021 and August 2022. Many hackers are taking advantage of human error for this, and companies are suffering.

So, how do we tackle push-bombing? Before answering this question, let’s define push-bombing.

What Is Push-Bombing?

Push-bombing is a common occurrence by hackers aimed at businesses and companies that use MFA to safeguard their data. MFA refers to the secure login process that aims at confirming the identity of the actor behind the login by using two or more devices to verify the “check.” This is just one of the numerous ways to verify user identity and is highly preferred given its simple process and UX benefits, of course.

Push-bombing is an approach by hackers where the malicious actor utilizes a bot or script to trigger several login attempts with illegally-procured login details and uses it to start a chain of multiple notifications to the user’s personal device repeatedly.

Below is a more explicit description:

• An attacker sends several push notifications to a user to force them to approve the login attempt accidentally.
• Understandably, a user will be hard-pressed to do so. With the number of messages and notifications sent, there will surely be an acceptance, whether out of frustration or accidentally, while using the device.
• Immediately after the user accepts one of the login attempts, the hacker logs in successfully, usually adds a device of their own, and proceeds to undertake malicious deeds and actions.

It is also common for such fraudulent attackers to come up with a narrative of being an IT admin from the same company which the innocent user works for, in a bid to persuade them to accept their login attempt.

What to Do to Protect Your Devices against Push-Bombing

In cybersecurity, the best way to repel an attack is to offer a lot of resistance in quantity and quality. Here are some ways to keep your devices safe from push-bombing:

1. Passwordless MFA

Fully passwordless MFA policies that meet FIDO standards fit the definition of phishing resistance approved by CISA. While some solution providers offer some level of FIDO authentication and use vulnerable approaches for contingencies as hackers do not waste time trying to take advantage. However, systems like these cannot be termed fully passwordless MFA.

Fully passwordless MFA that employ QR code scanning, for example, provide the most resilient protection against push-bombing. This is because the attack vector (passwords) is eliminated.

2. The use of password vaults

If your company is in the business of login details comprising usernames and passwords, ensure your employees use password vaults and managers. A better option is a full Privileged Authentication Management solution (PAM) for highly secure and sensitive logins. There should be constant reviews and checks of this process, and you can get an external managed IT professional to take a look too.

3. Password resets

If you suspect any credentials have been compromised, engage a password reset. This will help you avoid push-bombing in the future. While arbitrary password changing is not the best thing to do, forcing a password change or reset is an excellent way to limit how much time compromised credentials will be used during push-bombing.

4. Constant review of MFA configuration

It is essential to constantly review company MFA configurations. This is to check if basic access patterns are still as secure and sensible as possible. It is not uncommon to reconfigure the best MFA solutions as it will reduce access with limited verification.

5. Apply smart password best practices

You should also apply smart password best practices. Do not allow your staff to use the same login details for several services except when it is of the utmost importance. Hence, if a compromise occurs, the potential push-bombing attack surface is reduced.

Digital Crisis Can Help Protect Your Business Against Push-Bombing and Other MFA Fatigue Attacks!

If you are looking to increase your business’s cybersecurity levels, especially against push-bombing, then Digital Crisis is here for you. We provide managed IT services, top-notch IT cybersecurity, and 24/7 IT support. Contact us if you need any of these services.