When the attacker already has the password

Push prompts you weren't expecting are the whole attack, not a glitch.

Multi-factor authentication was supposed to make a stolen password worthless. For the most part it did, which is exactly why attackers went looking for the way around it.

The way around it is you. An attacker who already has your password signs in and lets your phone buzz. Then it buzzes again. Then a few more times, late at night, until you tap Approve to make it stop, or until you assume IT is doing something and wave it through. That tap is the whole attack. The second factor worked perfectly; it just asked the wrong person and got a yes. source

I've watched this land on sharp people. It works because it doesn't feel like an attack. It feels like a flaky app. The fix isn't to try harder to spot the bad prompt in the moment, because the bad prompt looks exactly like a real one.

The fix is to change what a prompt asks for. Number matching, where the screen shows a code you have to type into the app, turns a reflex tap into a deliberate act. You can't approve a login you didn't start, because you don't have the number. That one change closes most of this. source

Two more things help. Cut the number of prompts a normal day produces, because fatigue is the fuel here; the fewer legitimate buzzes, the more a strange one stands out. And give people a boring, blameless way to report a prompt they didn't trigger, because the person tapping Approve at midnight is usually trying to be helpful, not careless.

If your staff are getting login prompts they didn't start, that isn't noise to wait out. That's someone standing at the door with your key, trying the handle.

← All field notes