A MFA (Multi-Factor Authentication) reset attack is where a threat actor manipulates one of a few factors used to authenticate to a network. As a reminder, the strongest form of MFA is made up of the items below:

• Something a person has: a security token, a card, a key, a mobile device with an authenticator application, a mobile device which receives an 'SMS OTP’ (one time password)
• Something a person knows: a PIN or password
• Something a person is: biometric data such as a fingerprint or facial recognition
• Somewhere a person is: a specific connection point or GPS location

You can find out more about MFA in our previous article here.

The attacks that we are seeing are taking advantage of the ‘something you have' category. There has been an uplift in these attacks in recent months, as threat actors try and breach the perimeter of networks posing as a user that is legitimately authenticating.

Service Desk Compromise – Social Engineering (most common)

1. The threat actor calls the IT Service Desk of a business and uses information that’s in the public domain or has been leaked previously, to impersonate a legitimate employee
2. They use the information to convince service desk staff to reset the MFA Factor of the impersonated employee.
3. This could involve sending a new QR code to onboard the threat actor to an authenticator app (soft token)
4. Or they may change the phone number to which the OTP (One time password) is sent, to the threat actors mobile number instead of the employee

Mobile Phone Carrier Compromise – Social Engineering

1. This example is referred to as a ‘SIM swapping attack’
2. The threat actor calls the mobile phone network of an individual and persuades them to port the number currently associated with the MFA to a new sim (impersonating someone changing networks)
3. Information that’s in the public domain is used for this basic authentication e.g. pet’s name
4. The OTPs are then sent to the threat actors phone as they have the number of the victim under their control and linked to their handset

Mobile Phone Carrier Compromise – Credential Stuffing

1. Threat actor using credential stuffing (trying leaked passwords from other sites) to login to mobile phone network carrier website/mobile app
2. Requests phone number to be ported to new sim

Then as above Attack Path 2

Actions a business might take to reduce the likelihood of an MFA reset attack

Reviewing what MFA factors are being used by the business is another good form of mitigation, given the above attacks on the SMS OTP, many businesses may want to consider moving away from SMS as a factor. 

Make sure the service desk team validate the identity of employees ahead of performing an MFA reset using thorough checks. If there is no service desk involved, an approval flow should be considered. Regular monitoring post MFA changes enables the organisation to spot unusual activity following an MFA reset.

During the MFA reset process, the service desk team should look out for signs of fraud, for example:

Ensuring users are:

Furthermore, using a corporate PAM (Privileged Access Management) tool for the governance of highly privileged accounts can help mitigate the risk of these accounts being compromised.

Find out more about PAM here

Whatever the type of company, we can offer an appropriate cyber insurance service

Our knowledge of the cyber risk landscape gives us a deeper understanding of the different types of cyber risk – whether it’s the physical damage exposure of a big industry or the high volume of patient records stored by a hospital.

Get in touch with our Cyber team to find out more.