Lapsus$ along with SolarWinds hackers are both using the same method to bypass MFA
Not all MFA is created equal, as script kiddies and elite hackers have shown recently.
Multifactor authentication (MFA) is a core defense that is among the most effective at preventing account takeovers.
In addition to requiring that users provide a username and password, MFA ensures they must also use an additional factor–be it a fingerprint, physical security key, or one-time password–before they can access an account.
Nothing in this article should be construed as saying MFA isn’t anything other than essential.
Some forms of MFA are stronger than others, and recent events show that these weaker forms aren’t much of a hurdle for some hackers to clear.
In the past few months, suspected script kiddies like the Lapsus$ data extortion gang and elite Russian-state threat actors (like Cozy Bear, the group behind the SolarWinds hack) have successfully defeated the protection.
The most vital forms of MFA are based on a framework called FIDO2, which was developed by a consortium of companies balancing the needs of both security and simplicity of use.
It gives users the option of using fingerprint readers or cameras built into the devices or dedicated security keys to confirm they are authorized to access an account. FIDO2 forms of MFA are relatively new, so many services for both consumers and large organizations have yet to adopt them.
That’s where older, weaker forms of MFA come in.
Lapsus$ along with SolarWinds hackers are both using the same method to bypass MFA
They include one-time passwords sent through SMS or mobile apps like Google Authenticator or push prompts forwarded to a mobile device.
When someone is logging in with a valid password, they must either enter the one-time password into a field on the sign-in screen or push a button displayed on the screen of their phone.
Recent reports say this last form of authentication is being bypassed.
According to security firm Mandiant, one group using this technique is Cozy Bear, a band of elite hackers working for Russia’s Foreign Intelligence Service. The group also goes under Nobelium, APT29, and the Dukes.
“Many MFA providers allow for users to accept a phone app push notification or to receive a phone call and press a key as a second factor,” Mandiant researchers wrote.
“The [Nobelium] threat actor took advantage of this and issued multiple MFA requests to the end user’s legitimate device until the user accepted the authentication, allowing the threat actor to eventually gain access to the account.”
Lapsus$, a hacking gang that has breached Microsoft, Okta, and Nvidia in recent months, has also used the technique.”
No limit is placed on the amount of calls that can be made,” a member of Lapsus$ wrote on the group’s official Telegram channel.
“Call the employee 100 times at 1 am while he is trying to sleep, and he will more than likely accept it. Once the employee accepts the initial call, you can access the MFA enrollment portal and enroll another device.”
The Lapsus$ member claimed that the MFA prompt-bombing technique was effective against Microsoft, which said the hacking group was able to access the laptop of one of its employees earlier.
“Even Microsoft!” the person wrote. “Able to login to an employee’s Microsoft VPN from Germany and USA simultaneously, and they didn’t even seem to notice.
Also was able to re-enroll MFA twice.”
Mike Grover, a seller of red-team hacking tools for security professionals and a red-team consultant who goes by the Twitter handle _MG_, told Ars the technique is “fundamentally a single method that takes many forms: tricking the user to acknowledge an MFA request. ‘MFA Bombing’ has quickly become a descriptor, but this misses the more stealthy methods.”
Methods include:
- Sending many MFA requests and hoping the target finally accepts one to make the noise stop.
- Sending one or two prompts per day. This method often attracts less attention, but “there is still a good chance the target will accept the MFA request.”
- They call the target, pretend to be part of the company, and tell the prey they need to send an MFA request as part of a company process.
“Those are just a few examples,” Grover said, but it’s essential to know that mass bombing is NOT the only form this takes.”
In a Twitter thread, he wrote, “Red teams have been playing with variants on this for years. It’s helped companies fortunate enough to have a red team. But real world attackers are advancing on this faster than the collective posture of most companies has been improving.”
Other researchers quickly pointed out that the MFA prompt technique is not new.
“Lapsus$ did not invent ‘MFA prompt bombing,'” Greg Linares, a red-team professional, tweeted. “Please stop crediting them… as creating it. This attack vector has been a thing used in real world attacks 2 years before lapsus was a thing.”
India’s Crypto Trading Volume Plummets as New Tax Rules Enter Into Force
Top 5 Best Crypto Wallets for securing and managing your crypto assets
Honda CBR1000RR-R Fireblade Prices Reduced by Around Rs. 10 Lakh
Tata Motors Records Highest-Ever EV Sales In FY2021-22
United States Employment Rises by 431,000 in March 2022
Top 5 Best Crypto Wallets for securing and managing your crypto assets
Follow us or bookmark us for more Celeb Bio box office collection report celebrities trailers and promos
Join us on Facebook
Join us on Twitter
