What is a push-bombing attack and how to defend against it
💣 What is a push-bombing attack and how to defend against it 💣 A core problem for organizations after migrating to ☁️ cloud ☁️ has become sign-in.
💣 What is a push-bombing attack and how to defend against it 💣
A core problem for organizations after migrating to ☁️ cloud ☁️ has become sign-in. Think about how many things your company does that require a username and password. Employees keep signing into different systems and cloud apps.
Attackers use various methods to obtain those credentials. Their goal is user-level access to company data.
Wondering how much worse account compromise has gotten? Between 2019 and 2021, account-takeover incidents rose 307%.
🔐 Does multi-factor authentication solve password theft? 🔐
Yes — and no. Many organizations and individuals use multi-factor authentication (MFA). It's a way of stopping attackers who have obtained usernames and passwords by adding another layer (email or SMS authentication, or a phone app).
One way to bypass MFA is push-bombing.
🤓 How does push-bombing work? 🤓
In push-bombing, attackers already have the user's credentials. They attempt to sign in many times, sending the legitimate user a barrage of "push" notifications. Many people would question a single unsolicited prompt — but when bombarded, they can easily approve access by mistake.
⚔️ Ways to fight push-bombing in your organization ⚔️
📚 Educate staff 📚
Knowledge is power. Inform your staff about what push-bombing is and how it works. Train them on what to do if they receive an MFA prompt they didn't request.
🛡️ Use phishing-resistant MFA 🛡️
You can prevent push-bombing by switching to a different form of MFA. Phishing-resistant MFA uses a device passkey or a physical security key. Companies like Yubico, Kensington, Nitrokey, and others make physical authentication keys that completely sidestep push-bombing — there's no push prompt to approve. This is harder to set up, but much more secure than text- or app-based MFA.
🔑 Enforce unique strong passwords 🔑
For attackers to even send push prompts, they need user credentials. Enforcing unique, strong passwords significantly reduces the chance of a password being cracked. If you or your staff struggle to remember passwords, use a password manager — for example Bitwarden or Passbolt.
🆘 Need help improving identity and access security? 🆘
Multi-factor authentication alone isn't enough. Companies need multiple layers of protection to reduce the risk of cloud-service breaches.
Looking for help strengthening access security? Book a meeting with us today: https://calendly.com/roman-krutina-ict-group/30-minute-meeting