Push bombing is an attack method targeting Multi-Factor Authentication (MFA) systems, where attackers flood a target with rapid, repeated authentication requests. The goal is to pressure the user into mistakenly approving one of the requests, often out of frustration or confusion. Also referred to as MFA fatigue or authentication spam, push bombing is frequently employed in phishing attacks or by attackers who have already obtained a user's credentials and need to bypass the final MFA step.
Risks to the Organization
When a push bombing attack is successful, the consequences extend beyond just the individual user and can pose significant risks to the organization:
Data Breach: If attackers gain access to privileged accounts, they can extract sensitive information, such as customer data, financial records, or intellectual property. This can lead to significant financial and reputational damage.
Lateral Movement in the Network: Once inside the system, attackers can move laterally, escalating privileges to access more critical systems or deploy ransomware, malware, or other malicious actions.
Operational Disruptions: A breach caused by successful push bombing can lead to significant operational disruptions, halting business processes or critical services. Recovery from these attacks often involves costly downtime.
Compliance Violations: A data breach resulting from a compromised account due to push bombing can result in violations of data protection regulations (e.g., GDPR, HIPAA), leading to potential fines and legal consequences.
Loss of Trust: If sensitive customer or partner data is compromised due to a push bombing attack, it can damage the trust that stakeholders have in the organization, which may take years to rebuild.
By understanding these risks, organizations can take stronger steps to prevent and mitigate the effects of push bombing attacks.
Identifying Push Bombing: A User's Perspective
To identify push bombing, users should be aware of these common signs:
Multiple Authentication Requests in a Short Time: If you’re suddenly receiving repeated prompts for authentication that you didn’t initiate, it’s likely a push bombing attempt.
Requests at Odd Times: If you receive an MFA prompt at unusual hours, like late at night, or when you’re not attempting to log in, be alert—it could indicate suspicious activity.
Consistent Requests over Several Minutes: A sudden influx of prompts every few seconds or minutes is a sign of push bombing, as it tries to wear you down through sheer volume.
Unexpected Notification Source: If you receive an MFA request from a device, location, or application you don’t recognize, deny it immediately.
To help users better recognize push bombing and other similar threats, regular periodic training on attack methods that specifically target users, such as phishing, spear phishing, and push bombing, should be part of the organization’s security protocol. This training should focus on improving user awareness of these attacks and reinforcing the importance of not approving requests without deliberate intent.
Additionally, users who have previously fallen victim to push bombing attacks should receive targeted education on recognizing and responding to these threats. This could involve one-on-one training, review of best practices, and tools to help them stay vigilant. The goal is to empower users with the knowledge they need to react appropriately and minimize the risk of future incidents.
Implementing Technical Controls to Prevent and Respond to Push Bombing
Organizations can take several proactive steps to detect and automate responses to MFA push bombing attacks. Here are some key technical controls and strategies:
Limit the Number of MFA Requests Per Minute:
Configure your MFA system to restrict the number of authentication attempts allowed within a specific time frame. For example, if a user receives more than three requests in a minute, the system can temporarily block further attempts, alert the user, and notify the IT security team.
Require Step-Up Authentication:
For high-risk scenarios, require an additional layer of security (like a biometric scan or security question) if repeated MFA requests are detected. This can reduce the likelihood of an attacker getting through.
Alerting and Monitoring:
Set up monitoring for unusual MFA request patterns. Tools like SIEM (Security Information and Event Management) can help detect these patterns and automate alerts to security teams, enabling rapid response.
User Behavior Analytics (UBA):
Implement UBA to recognize abnormal login attempts. UBA can track typical user behavior, and if the system detects unusual login attempts—such as MFA requests coming from a new location or IP—it can flag it as suspicious and initiate an investigation.
Enable Number Matching:
Configure MFA systems to include a number matching process. Rather than simply approving a push notification, users need to match a number displayed on their mobile device with one shown on the application, reducing the chance of accidental approvals.
Educate Users on MFA Security Practices:
Regularly inform users about the dangers of push bombing and how to respond if they encounter it. Users should understand that approving a request they didn’t initiate is never safe and could lead to a security breach.
Implement Adaptive MFA:
Adaptive MFA leverages context-based factors such as IP address, geolocation, and time of day to determine the legitimacy of a login attempt. For example, if an unusual pattern is detected, like a login attempt from a new country, the system can trigger additional authentication requirements or deny the attempt altogether.
How to Prevent Push Bombing Using Microsoft Authenticator
Microsoft Authenticator includes several features that can help prevent push bombing attacks:
Number Matching: Microsoft recently introduced number matching, which requires users to enter a number displayed on the login screen into their mobile app, reducing the likelihood of accidental approvals.
Geolocation: This feature shows the user the location of the sign-in attempt, so if the login originates from an unfamiliar location, users can easily detect suspicious activity.
Custom Notifications: Microsoft Authenticator allows organizations to configure notifications to include more context, like which application is requesting access and the device trying to log in, helping users identify fraudulent attempts more easily.
Notification Timeouts: Configuring short timeouts on authentication requests ensures that users have limited time to approve a request, making it more difficult for attackers to rely on user fatigue.
How to Prevent Push Bombing Using DUO
DUO Security offers several capabilities to prevent push bombing attacks:
Number Matching: DUO also supports number matching, where users must match a code displayed on their login screen with the one in the DUO mobile app before granting access.
Limit Repeated Pushes: DUO can automatically block or limit the number of push notifications a user can receive in a short time, reducing the chances of an attacker flooding the user with requests.
Fraud Alerts: DUO allows users to report fraudulent push attempts directly from the app. This immediately notifies the security team and can block future attempts from the same device.
Adaptive Authentication Policies: DUO enables organizations to set stricter authentication policies for high-risk scenarios, such as requiring step-up authentication (like biometrics) or blocking logins based on geolocation or network.
Push bombing attacks pose serious risks to both users and organizations, threatening to compromise sensitive data, disrupt operations, and damage trust. By understanding the dangers of push bombing, organizations can implement robust technical controls and develop proactive user education programs to prevent and respond to these attacks. A multi-layered approach, combining user awareness, adaptive MFA systems, and automated threat detection, ensures that organizations remain resilient against push bombing and other evolving cyber threats.
We specialize in cybersecurity management and support services that help organizations defend against threats like push bombing, phishing, and more. With fractional outsourcing, you gain access to a dedicated team of cybersecurity experts without the need for full-time staff, saving you money while ensuring top-tier protection.
Contact us today to learn how our customized solutions can enhance your security posture and provide peace of mind in a rapidly changing threat landscape.
留言