What is a push-bombing attack and how to defend against it

💣 A fundamental problem for organizations after migrating to ☁️ the cloud ☁️ became sign-ins. Think about it…

💣 What is a push-bombing attack and how to defend against it 💣

A core problem for organizations after migrating to ☁️ cloud ☁️ has become sign-in. Think about how many things your company does that require a username and password. Employees keep signing into different systems and cloud apps.

Attackers use various methods to obtain those credentials. Their goal is user-level access to company data.

Wondering how much worse account compromise has gotten? Between 2019 and 2021, account-takeover incidents rose 307%.

🔐 Does multi-factor authentication solve password theft? 🔐

Yes — and no. Many organizations and individuals use multi-factor authentication (MFA). It's a way of stopping attackers who have obtained usernames and passwords by adding another layer (email or SMS authentication, or a phone app).

One way to bypass MFA is push-bombing.

🤓 How does push-bombing work? 🤓

In push-bombing, attackers already have the user's credentials. They attempt to sign in many times, sending the legitimate user a barrage of "push" notifications. Many people would question a single unsolicited prompt — but when bombarded, they can easily approve access by mistake.

⚔️ Ways to fight push-bombing in your organization ⚔️

📚 Educate staff 📚

Knowledge is power. Inform your staff about what push-bombing is and how it works. Train them on what to do if they receive an MFA prompt they didn't request.

🛡️ Use phishing-resistant MFA 🛡️

You can prevent push-bombing by switching to a different form of MFA. Phishing-resistant MFA uses a device passkey or a physical security key. Companies like Yubico, Kensington, Nitrokey, and others make physical authentication keys that completely sidestep push-bombing — there's no push prompt to approve. This is harder to set up, but much more secure than text- or app-based MFA.

🔑 Enforce unique strong passwords 🔑

For attackers to even send push prompts, they need user credentials. Enforcing unique, strong passwords significantly reduces the chance of a password being cracked. If you or your staff struggle to remember passwords, use a password manager — for example Bitwarden or Passbolt.

🆘 Need help improving identity and access security? 🆘

Multi-factor authentication alone isn't enough. Companies need multiple layers of protection to reduce the risk of cloud-service breaches.

Looking for help strengthening access security? Book a meeting with us today: https://calendly.com/roman-krutina-ict-group/30-minute-meeting