How Cybercriminals Avoid MFA and Tips to Stop Them

As we often point out, layered defenses are essential for protecting valuable assets because there is no bulletproof solution in the security industry. Case in point: while multi-factor authentication (MFA) is considered one of the most crucial security defenses in existence, cybercriminals can still find ways to bypass it. SecurityInfoWatch published an article by Alexandre Cagnoni, our Director of Authentication titled "How hackers bypass MFA and ways to stop them." Here is an excerpt:

"So, what are the top tactics hackers use to bypass MFA and what can you do to stop them? Let’s start by taking a closer look at the various approaches to authentication, along with some of the most popular techniques to bypass them.

SMS: Since most mobile phone users always have their device on or near their person, SMS text messaging is one of the most commonly used MFA technologies. Though convenient, it is one of the least secure options. In 2016, the National Institute of Standards and Technology (NIST) issued a guideline that warned against using SMS as a factor of authentication, citing examples of endpoint compromise and social engineering attacks to show how easily malicious actors can intercept, phish, and spoof text messages. “SIM swapping” is a popular trick attackers use to bypass SMS-based MFA. In a SIM swap scam, a hacker impersonates the target to dupe a wireless carrier employee into porting the phone number associated with their SIM card to a new (malicious) device. Following the migration, the hacker can intercept any two-factor authentication codes sent by text message. Authenticator application solutions can help prevent SMS hijacking and SIM swapping bypass techniques."

Read the full article on SecurityInfoWatch to learn about the other ways hackers can bypass MFA and how to protect yourself.