Skip to content

Multi-Factor Protection is Not Foolproof

  1. Home
  2. Tuesday With Tim
  3. Multi-Factor Protection is Not Foolproof

Multi-Factor Protection is Not Foolproof

Multi–factor protection is a great way to add a layer of protection beyond just a password to prevent unauthorized access to systems. A password can be easily hacked or available on the dark web and could allow a bad actor into the system. When you enable multi–factor authentication, your logins are protected through an app or text message that will allow you to validate that it is you logging into the system and not someone else. Unfortunately, due to the changing cybersecurity landscape, hackers are always coming up with new ways to bypass security measures. There are several methods to get around multi-factor authentication, these are 3 ways that PCH Technologies has seen this accomplished: 

  1. The use of social engineering by calling into tech support pretending to be the end-user and knowing some personal information to get the tech support representative to bypass or remove multi–factor authentication from your email system.
  2. The use of social engineering to call into a mobile phone company pretending to be the end-user getting a new phone and performing a SIM swap that allows SMS messages including multi-factor codes get sent to the bad actor’s phone.
  3. On an end-user‘s computer, where the website is redirected to a fake multi–factor page where a bad actor will then harvest the multi-factor code entered to gain access to the real systems.  

So, how can you prepare for if this happens to you? Well, beyond having multi–factor protection, it is important to make sure notifications are turned on for changes to your accounts so you can act quickly if someone is trying to turn off multi-factor or trying to reset your passwords. In addition, it is important to not share your personal information, including your security questions that could be used to validate you over the phone with your phone carrier or technical support. Also, whenever possible use an application-based multi-factor, instead of a text message multi–factor to reduce the risk in case of a SIM swap. Overall, cybersecurity is something that is always changing so it is important to be aware of the tendencies of hackers so you can avoid a situation like this.  

If you want to find out even more ways multi-factor can be hacked, here is a great eBook from KnowBe4 by Roger Grimes called “12+ Ways to Hack Multi-Factor Authentication”.

 https://www.knowbe4.com/hubfs/12+_Ways_to_Hack_Two-Factor_Authentication-1.pdf