English
Menu

Cyber Attacks and Defense in Practice

An attacker obtained an employee's password and repeated the login dozens of times, flooding the employee's smartphone with notifications asking for approval. The employee got annoyed and pressed "Approve" without thinking. Which of the following is the most appropriate countermeasure to this attack?

  1. AMake the notification sound quieter so that employees are not bothered and can keep working even when many approval requests arrive
  2. BIncreasing the minimum password length eliminates the risk of employees approving even when approval requests from an attacker arrive
  3. CIntroduce entry of the number shown on the screen into the app and limits on mass requests, and have employees report notifications they did not trigger
Show answer and explanation

Answer: C. Introduce entry of the number shown on the screen into the app and limits on mass requests, and have employees report notifications they did not trigger

This kind of attack is called MFA fatigue (push bombing) and exploits the weakness of methods in which authentication completes just by pressing "Approve" in a notification. With number matching, approval is impossible without entering the number shown on the login screen, so users who did not log in themselves cannot approve. Measures such as stopping mass requests in a short time, showing location and application information in the notification and having users report notifications they did not trigger are combined. More fundamentally, organizations move to phishing-resistant methods, such as FIDO2 passkeys, that cannot be used on fake sites or for someone else's login.

  • A. Making notifications less noticeable makes suspicious ones easier to overlook.
  • B. It has no effect on a password that has already been obtained, and the problem of pressing approve remains.
  • C. Correct. Tie the approval action to the user's own login and stop mass requests.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following is the correct reason why authentication with FIDO2 (WebAuthn) passkeys is considered more resistant to phishing than one-time passwords (OTPs)?
  2. A web service saw a large number of login attempts from many different IP addresses, each using a different user's ID and password pair, and some succeeded. Many of the pairs tried matched ones leaked from other services. What is this attack called?
  3. At a cloud email service that uses multi-factor authentication, an employee was lured to a login screen that looked exactly like the real one and entered a password and a one-time password. The attacker used that screen as a relay to the real service, stole the session cookie issued after login and impersonated the employee. Which of the following most appropriately describes this attack and the countermeasures?
  4. Which of the following is the most appropriate idea of privileged access management (PAM) for protecting server administrator accounts?
  5. A developer accidentally committed a configuration file containing an API key for a cloud service to a public Git repository. On noticing, the developer immediately committed a change deleting the file. Which of the following is the most appropriate response after this?

Comparisons in this topic