Connect with us

Hi, what are you looking for?


Identity & Access

When Multi-Factor Authentication Fails

Recently, we’ve seen evidence of the increase in insider threats related to outsiders obtaining and abus

Recently, we’ve seen evidence of the increase in insider threats related to outsiders obtaining and abusing insider credentials. Like others, I’ve pointed to multi-factor authentication (MFA) as a means to mitigate the risk posed by this attack method. But, it’s worth considering – what are the limitations of MFA in reducing the risk of outsiders abusing insider credentials?

To be fair, has any security control has ever proven to be 100 percent effective? Even networks with an air gap to the Internet are vulnerable to malware on a USB memory stick given to an employee.

Similarly, while MFA will present a harder target for password pirates, what possibilities exist in a “what could go wrong analysis?” What risks remain that should at least be considered for further mitigation? Here are five examples of situations where MFA may fail in preventing outsiders from getting in.

The “outsourcer”

You’ve probably heard the story of the developer who outsourced his job to China, so he could surf Reddit, shop on eBay and update his social media feeds, while still delivering on his job responsibilities. His employer, a critical US infrastructure company, was trying to do the right thing by implementing two-factor authentication via RSA tokens to access their VPN. But, they didn’t consider a coder willingly shipping his login credentials to a Chinese consulting firm so he could have them do his work for him for a fraction of his pay. 

Multi-Factor Authentication Failure

The “helper”

Biometrics provide a way of demonstrating “something you are” in the three factors of MFA, but what happens when someone has their hand in a cast and can’t submit a thumb or hand print? Or how about the persuasive and attractive or harried worker who “left their key card at home?” There is a real possibility that a security guard or a co-worker is going to help them out. 

The “re-director”

Advertisement. Scroll to continue reading.

One-time passwords used in hardware tokens, as a soft token via a mobile app, or via SMS, are susceptible to interception. This can occur through malware running on the machine or mobile device used to gain access, or in the mobile carrier’s network. Malware can be used to block a legitimate user request while capturing the credentials for an immediate replay for the attacker. SIM cards can be spoofed. With the rise of vulnerabilities on mobile devices, and increased access via mobile platforms, this is a growing possibility.

The “sharer”

An experiment conducted at New York University revealed that the verification code sent to a user’s mobile phone via SMS for password resets can be obtained simply by asking the user to forward the code. Twenty-five percent of users were willing to share the digits when the attacker followed up the SMS with an official-sounding text that asked for verification from the legitimate provider. If the attacker had managed to obtain the password already, then he would have access to the account when the user provided the code to verify possession of “something you have” – in this case the phone.

The “synchronizer”

Synchronization between desktop browsers for clients and mobile equivalents are convenient and popular. They allow us to share SMS messages or the same web site bookmarks across platforms, for example. According to research at the University of Amsterdam, however, they can also be used to compromise mobile-based MFA. If the desktop is compromised (say via a drive by download), then the synchronization provides an opportunity for features, such as Google Play’s remote app installation, to install malware on the user’s mobile device. Once one device is compromised, so is any MFA that depends on it. 

What can be done to combat the limitations of MFA? 

Each of these examples (and more are sure to arise) can be mitigated with different approaches. Since most relate to people behaving in an insecure manner, education is one obvious method for mitigation. Given that there are at least three factors possible in MFA, adding more complex access controls is another approach, but, the inconvenience for users has to be considered in this case. 

What should also be considered is that eventually a determined attacker will find a way to compromise credentials. Therefore, we must not only control access, but monitor what users are doing with their access, looking for abnormal patterns that would indicate an attack in progress. This concept of merging user behavior analytics and security analytics with identity analytics is in its infancy, but provides the possibility of preventing or limiting damage from compromised credentials. 

Like all security measures, MFA is not an instant fix to safeguard credentials. But, understanding the risks of MFA limitations is the first step towards mitigation.

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.


As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.


Expert Insights

Related Content

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...


The private equity firm merges the newly acquired ForgeRock with Ping Identity, combining two of the biggest names in enterprise IAM market.


Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Email Security

Many Fortune 500, FTSE 100 and ASX 100 companies have failed to properly implement the DMARC standard, exposing their customers and partners to phishing...

CISO Strategy

Okta is blaming the recent hack of its support system on an employee who logged into a personal Google account on a company-managed laptop.

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...