Why MFA Alone Will No Longer Suffice

This article originally appeared in SC Media.

Account takeover attacks have become top of mind for today’s security leaders, and it’s clear why: if gone undetected, these incidents can lead to significant financial losses, business disruption, and reputational damage.

Just about every year we see at least one major attack stemming from account compromise—from the Colonial Pipeline ransomware attack in 2021, to Uber’s data breach in 2022, to the U.S. State Department’s email breach by Chinese hackers last year. No one wants to become the next account takeover victim to make news headlines, but preventing these attacks requires very hard work.

Account takeovers are only growing in prevalence, as threat actors continue to see success in their attempts to harvest credentials, steal active session cookies, or otherwise gain access to email and cloud software accounts. There are several reasons for this growth—including an uptick in phishing and social engineering, fueled by the rise of generative AI.

One of our recent surveys found that 70% of security leaders view account takeovers as the greatest concern to their organization, even ahead of ransomware and phishing. And it’s not just email account compromise that they are concerned about. As the number of cloud applications—including collaboration and SaaS apps, cloud infrastructure accounts, and identity platforms—continues to grow within enterprises, so does the attack surface.

Eighty-three percent of organizations have been directly impacted by an account takeover attack within the past year, so it’s no wonder that nearly all security stakeholders (99%) cite account compromise prevention as a top priority. But how effective are their prevention strategies?

Recommended by NIST and Microsoft and many others in the industry, multi-factor authentication, or MFA, has long been viewed as the gold standard in protecting against account takeovers. But organizations need to understand that MFA isn’t a silver bullet. In fact, advisory firm Kroll recently noted an uptick in attacks resulting in unauthorized account access, and of those organizations that were breached, 90% had MFA in place.

Like any security measure, attackers can get past MFA. Here are four of the most common ways attackers breach MFA:

• Session Hijacking: In these attacks, threat actors compromise an active authentication session—typically by purchasing an MFA token off of the dark web, forging it, or stealing it via adversary-in-the-middle tactics. We’re now commonly seeing threat groups such as Robin Banks, EvilProxy, and W3LL build and sell phishing-as-a-service kits designed to help attackers bypass MFA protocols. With this dark market, there’s a lower barrier to entry for amateur threat actors who simply need to purchase a software license to begin circumventing MFA.

• MFA Fatigue: This MFA bypass technique involves sending a barrage of push notifications to a legitimate user’s device in an effort to frustrate or distract the user into accepting the request to stop the notifications. It’s particularly dangerous because it relies on human error, which makes it difficult to defend against. In recent years, MFA fatigue attacks have been used to successfully compromise accounts at both Microsoft and Cisco.

• Exploiting Single Sign-on: Single sign-on (SSO) offers convenience for end users by giving them one place where they can authenticate to access all their applications. However, this gives attackers the opportunity to exploit that very same convenience. They only need to compromise one identity platform to gain access to other connected applications that would normally require MFA. Golden SAML, a sophisticated attack technique that exploits the SAML single sign-on protocol, was used in the SolarWinds attack of 2020—one of the largest breaches in recent history.

• Helpdesk Social Engineering: Attackers can use social engineering to trick helpdesks into bypassing MFA, by impersonating employees in messages or phone calls to request forgotten passwords. Service desk social engineering has been used by the infamous Scattered Spider threat group that attacked MGM Resorts and Caesars Entertainment last year.

As these examples show, MFA alone will no longer suffice to keep users safe. Despite it being one of the most commonly used security measures to prevent account compromise, a mere 37% of security stakeholders have strong confidence in its effectiveness in protecting against these attacks.

So while MFA may reduce the number of successful account takeover attempts, it falls short of effectively preventing the threat—and does nothing to detect or remediate accounts once an attacker has gained access.

Organizations need a layered security strategy, which should include MFA but also deliver complete visibility and unified control across the cloud application ecosystem. Because account takeover attacks unfold so quickly as attackers move laterally across the corporate network, it’s critical for security teams to be able to identify and automatically remediate compromised accounts.

Slowing down attackers isn’t enough: we must actually stop them in their tracks before they have a chance to wreak havoc.

For more insights into how modern security leaders are addressing the threat of account takeover, download the 2024 State of Cloud Account Takeover Attacks.