by Serguey Shinder
In September 2024, at about twenty to midnight on a Sunday, the manager of one of our Yorkshire branches was woken by his phone. It was the authenticator app, asking whether he was trying to sign in to his work account. He was not, so he pressed deny. Two minutes later it asked again, and again after that. By the fortieth request he had decided, half asleep, that it was some fault in the system, and he pressed approve so that he could go back to bed.
Whoever was asking already had his password, reused on a forum breached years earlier. What they lacked was his second factor, and our second factor was a yes or no question that we let anybody holding the password ask as often as they liked. They signed in, read his mailbox for three hours, and sent eleven emails from it to branch staff asking them to check an attached updated price list, which was not a price list. Two people opened it, and our endpoint protection stopped both, which is why this is a short story.
I had always thought of the approval prompt as the strong part of our sign in. I had not thought about what it gave an attacker: a way to reach a real person, at a time of their choosing, and ask them for a decision over and over, with nothing on the screen to tell a stranger's request from his own. Every prompt looked the same. Every prompt he had ever seen before had been his. And for three years we had taught everybody that approving it was simply part of logging in.
When we went through the previous year's sign in records, sixty three other accounts had received more than five prompts in an hour that their owner had not started. Most had been denied. Four had been approved.
We changed how the question is asked. The prompt now shows the location and the application, and it asks for a two digit number that appears only on the screen being signed in to, so a request you did not start cannot be approved by tapping. After three denials the account stops sending prompts and raises an alert to our service desk, which rings the person in the morning. And the prompt carries a button that says this was not me, which blocks the attempt and starts a password reset in one step.
The branch manager told us himself on the Monday morning, embarrassed. I thanked him, because the hardest part of the investigation had been done by somebody honest enough to say what he had pressed.
A second factor that can be asked for forty times in one night is no longer asking who you are. It is asking how tired you are.
– Serguey Asael Shinder
Leave a Reply