top of page

Understanding Push-Bombing: Examples and Prevention Strategies



G' day Again, In our interconnected world, we cannot deny the reliance, on usernames and passwords. Every day employees have to navigate through systems or cloud applications each requiring its unique login information.


Unfortunately, cybercriminals are always on the lookout for these details. Their goal? To impersonate users, gain access to data carry out advanced attacks, and even send deceptive phishing emails.


The seriousness of account breaches is clear. From 2019 to 2021 incidents of account takeover (ATO) increased significantly by 307%.


What about Multi-Factor Authentication (MFA)? Isn't it the solution?

MFA has been a trusted ally for both organisations and individuals in protecting against access. Its track record in securing cloud accounts is commendable.


However, its effectiveness has led hackers to come up with workarounds. This brings us to "push bombing."


Understanding Push Bombing

MFA typically involves a two-step verification process. After entering their credentials users receive an authorisation request through means such, as SMS/text messages, device popups or app notifications.


While this is a part of MFA protocols push bombing takes advantage of it. Cybercriminals armed with stolen credentials launch multiple login attempts and flood the user's device with a number of push notifications.

In the midst of all these attacks, users might unintentionally grant access without realizing it.


Push bombing is a tactic used in engineering, with the goal of.


1. Disorienting the user

2. Testing the limits of the user's patience

3. Tricking the user into approving MFA requests


Ways to Protect Against Push Bombing


1. Educate and Empower: It's important to inform your team about push bombing how it works and what steps they should take if they come across MFA prompts. Establish a reporting system to keep your IT team informed.


2. Reduce App Overload; On average employees handle around 36 cloud services daily. Simplifying and consolidating these services can minimize entry points for hackers. Platforms like Microsoft 365 and Google Workspace offer tools within one login improving both security and efficiency.


3. Choose Phishing Resistant MFA; Consider switching to MFA methods that are resistant to phishing attempts, such as device passkeys or physical security keys. These methods eliminate the need for push notifications. Provide defense against attacks.


4. Promote Strong Password Practices; A push bombing attack relies on having access to user credentials. By following password protocols you can reduce the chances of breaches. This includes using a variety of characters, in passwords, avoiding information and refraining from using the password across different platforms.

5. Incorporate Advanced Identity Management; By utilizing identity management tools you can streamline login processes through sign-on solutions. These tools also have the capability to enforce contextual login policies adding a layer of security based on factors such, as location and time.


Strengthening Your Digital Protections

While multi-factor authentication (MFA) is a tool it should not be relied upon as the solution. It is essential to implement a faceted defence strategy to minimize the potential risks associated with cloud breaches.


Looking for expert guidance to enhance your access security? Please reach out to us Q10 Systems today for a discussion, about safeguarding your business.

10 views

Comments


bottom of page