Defending Against MFA Attack Techniques

The content in this article is part of Episode 5 of the Detection Engineering Dispatch series, presented by Sota Aoki, former Security Engineer at Rakuten, and Rohith Kondeti, Forward Deployed Engineer at Anvilogic.

As the cybersecurity landscape evolves, one threat that consistently garners attention is multi-factor authentication (MFA) attacks. These attacks exploit user authentication vulnerabilities, stealthily deploying a wave of simultaneous login attempts to gain unauthorized access. Seasoned security practitioners recognize the demand to continually fortify their detection engineering abilities and remain at the forefront of preventing such insidious tactics.

To understand an MFA attack's complexity, let's delve into a few real-world instances that underscore this security threat's magnitude: an MFA attack leverages frailties within the authentication process. Here, adversaries covertly overwhelm the system with login prompts to infiltrate the digital environment. Experienced practitioners in the field are responsible for consistently enhancing detection engineering skills and staying ahead of such stealthy maneuvers.

Examples of MFA Attacks

Unraveling the intricacies of an MFA attack can prove challenging. Let’s take a look at some case studies that explain the implications of this pervasive security concern.

Uber IT System Breach: A Cautionary Tale

In September 2022, Uber, a renowned transportation technology company, suffered a grave security breach. In this incident, the attacker masqueraded as an IT team member, employing social engineering techniques to deceive the unsuspecting employee. The attacker wore down the employee's defenses through repeated push notifications, ultimately gaining their approval. This simple act served as the gateway to compromising the integrity of Uber's IT infrastructure.

CISCO VPN Compromise: Unraveling the Intrusion

In May 2022, another prominent organization, Cisco, fell victim to a cleverly orchestrated MFA attack. The attacker initiated the assault by compromising a personal Google account containing Cisco credentials, giving them a foot in the door. Employing a combination of sophisticated vishing attacks and repeated push notifications, the assaulter adeptly manipulated an employee into granting them access.

The significance of these examples lies in their demonstration of the malleable nature of MFA attacks. With cunning tactics, attackers can exploit the vulnerabilities within an organization's security posture. These instances are an impetus for expert security practitioners like ourselves to bolster our detection engineering skills.

By broadening our knowledge and staying attuned to emerging threats, we can effectively stay one step ahead of malicious attacks. So, let's dive deeper into detection engineering, equipping ourselves with the skills necessary to combat MFA attacks and safeguard the digital landscape.

Common Challenges in Deploying Detection Use Cases

Detection engineering presents several common challenges that security practitioners must navigate. Alert fatigue stands out as one of the most significant obstacles. With numerous alerts flooding their systems, prioritizing and investigating each one can be overwhelming — like finding a needle in a haystack without getting pricked!

Another issue encountered by detection engineers is the lack of context when dealing with individual detections. Understanding the broader picture is crucial for piecing together the puzzle and accurately identifying the true nature of threats.

Furthermore, grappling with chain attacks can be a complex task for detection engineers. Identifying the interconnected steps and their impact can be like playing a game of chess, where each move has consequences that can determine the outcome.

Building on your detection engineering skills requires overcoming these challenges with innovative strategies.

Mitigating MFA Attacks: Proactive Measures to Strengthen Multi-Factor Authentication Security

User Training and Education: User awareness plays in combating social engineering attacks. By imparting knowledge about these attacks' existence and potential dangers, organizations are empowered to recognize suspicious activities effectively. The result? A more vigilant workforce, actively protecting themselves and the organization from falling victim to such malicious schemes.

Enhancing Multi-Factor Authentication (MFA): While push notifications remain fundamental to MFA, taking it a step further and exploring time-based one-time passwords (TOTP) or number matching proves innovative. Incorporating these additional layers of security ensures that users authenticate themselves and validate their identity by entering a randomly generated number along with their MFA credentials. This approach significantly reduces the risk of unknowingly granting access to attackers.

Striking the Right Balance: Finding that sweet spot is crucial when it comes to authentication attempts. Limiting the number of authentication attempts protects detection engineers from being overwhelmed by excessive or fraudulent push notifications. Establishing clear limits creates a manageable authentication process that promotes efficiency and security, strengthening the defense against unauthorized access attempts.

Elevating Log Visibility: Security practitioners recognize the value of monitoring onboarding logs. These logs provide valuable insights into traditional or abacus patterns, enabling a deeper understanding of potential threats. By honing detection engineering skills, the ability to identify and respond to abnormal MFA activities is sharpened with confidence.

Building Customized Detection Use Cases: As detection engineers, it is essential to research and develop robust detection mechanisms. Building customized use cases tailored to the organization's unique security needs ensures staying one step ahead of attackers. Furthermore, leveraging associated alerts and being intimately familiar with the log set enables proactive detection and mitigation of threats.

Supercharge Your MFA Attack Detections with Anvilogic 

Some detections are non-negotiable – they have to happen, and they need to be noisy enough to catch your attention. This is particularly true when it comes to MFA attack detection. Attackers are becoming increasingly sophisticated, and the consequences of a successful breach can be catastrophic. Organizations need a proactive approach to identify and mitigate threats before they escalate.

The Anvilogic framework revolutionizes the way we approach MFA attack detection by simplifying the process and improving the accuracy of alerts. Here's how it works:

1. Data Gathering and Detection

Anvilogic starts by gathering the data you need for MFA attack detection. Whether you're working with authentication logs, endpoint logs, or network logs, Anvilogic ensures that you have access to the right data feeds. The framework then takes care of the actual detection piece, scouring the data for specific patterns or use cases.

2. Data Normalization

Diverse data sets often suffer from an inconsistency in field names. For example, the field “Source IP” might also have the field name “Source” or “SRC IP” accross different data sources. Anvilogic normalizes this data using normalization macros. This critical step ensures that all relevant data is structured consistently, and is especially important if you’re looking at authentication logs, endpoint logs, or even network logs.

3. Data Indexing

Anvilogic then indexes the normalized data into what is known as the Anvilogic index. This index functions similarly to a hunting or summary index, allowing you to store and access interesting signals and events efficiently.

4. Correlation and Scenario Building

Once you have a list of interesting signals and events, the framework taps into Anvilogic’s low/no-code scenario builder. This tool makes it easy to create custom detections and to build correlated detections for particular events.  

With Anvilogic's scenario builder, there's no longer a need for manual use case creation using complex query languages like SPL, SQL, or KQL. Anvilogic empowers detection engineers to get back to doing what they do best – safeguarding your organization from threats with confidence. 

See how powerful Anvilogic can be for MFA Attack Detection with our free trial.