Does MFA Solve the Threat of Account Takeover?

For criminals trying to conduct account takeover fraud via credential stuffing, multifactor authentication (MFA) adds hurdles, but attackers have discovered ways to bypass MFA, meaning that MFA by itself does not eliminate the threat of account takeover. Enterprises need to take additional measures to bolster the security of MFA, including bot mitigation and the monitoring of contextual risk.

Regardless of its weaknesses, MFA is a significant step forward because password-only authentication has clearly failed. We humans simply cannot remember long strings of characters, and so we take shortcuts, choosing simple, predictable passwords and reusing passwords across applications, all of which has led to many security breaches.

However, with the failure of passwords and the adoption of MFA, we have seen a rise in attacks against MFA such as:

Real-Time Phishing Proxies

In a real-time phishing proxy (RTPP) attack, fraudsters use phishing messages to fool users into visiting an attacker-controlled site that looks like a trusted site, enticing the user to enter their credentials and approve the second factor authentication request, whether that is an SMS message or a push notification. The RTPP forwards the credentials to the target app and gains access. For a demo of the attack, see this video by hacker and security consultant Kevin Mitnick, and for background on the growth of real-time phishing proxies, see the F5 Labs Phishing and Fraud Report.

MFA Bombing

In MFA bombing attacks, the attacker tricks the target into giving them their authentication code by sending multiple fraudulent requests for the code. This works best against authenticator apps that rely on push notifications because the user can so easily make the flood of requests stop through the press of a button. Attackers sometimes combine MFA bombing with social engineering to encourage users to accept the push notification and grant access.

Biometric Spoofing

Attackers have even bypassed biometric authentication. After all, we leave our fingerprints all over the place, on nearly every smooth surface we touch, where they can be collected and replicated using anything from a 3D printer to gummy bear ingredients. Security researchers have also demonstrated the spoofing of facial and voice recognition as well as iris scanning. While vendors have developed anti-spoofing techniques such as liveness checks to detect bypass attempts, any given biometric device might become vulnerable as attackers advance the state of the art.

SIM Swapping

SIM swapping involves fraudsters exploiting the ability of service providers to transfer a phone number to another device. The fraudster gathers personal information on the victim and then social engineers a support person to transfer the victim’s phone number to the fraudster’s SIM. With control over the victim’s phone service, the fraudster receives the text messages intended for the user, which allows them to intercept one-time passwords (OTPs) and bypass MFA.