Why MFA alone won’t protect you in the age of adversarial AI

For a long time, multi-factor authentication (MFA) — in the way of push notifications, authenticator apps or other secondary steps — was thought to be the answer to the mounting cybersecurity problem. 

But hackers are cunning and crafty and come up with new ways all the time to break through the fortress of MFA. 

Today’s enterprises need even stronger defenses — while experts say MFA is still critical, it should be just a small piece of the authentication process. 

“Traditional MFA methods, such as SMS and push notifications, have proven to be vulnerable to various attacks, making them nearly as susceptible as passwords alone,” said Frank Dickson, group VP for security and trust at IDC. “The growing prevalence of sophisticated threats requires a move towards stronger authentication methods.”

Why isn’t MFA enough?

The once tried-and-true practice of relying on passwords now seems quaint. 

No matter what string of numbers, letters, special characters or numbers they comprised, they became so easy to steal as users were careless, lazy, gullible or overtrusting.

“Traditional passwords are simply shared secrets, not much more advanced than a Roman sentry asking for the secret codeword thousands of years ago (‘Halt, who goes there? What’s the passcode?),” said  Lou Steinberg, founder and managing partner at CTM insights. 

As Matt Caulfield, VP of product for identity security at Cisco, told VentureBeat: “As soon as those were stolen, it was game over.”

MFA became more mainstream in the mid-1990s to 2000s as more enterprises went online, and it seemed a solution to traditional passwords. But with digital transformation, the shift to the cloud, and the adoption of dozens or even hundreds of SaaS apps, enterprises are more vulnerable than ever. They no longer safely hide away behind firewalls and data centers. They lack control and transparency. 

“MFA changed the game for a long time,” said Caulfield. “But what we’ve found over the past 5 years with these recent identity attacks is that MFA can easily be defeated.”

One of the greatest threats to MFA is social engineering or more personalized psychological tactics. Because people put so much of themselves online — via social media or LinkedIn — attackers have free reign to research anyone in the world. 

Thanks to increasingly sophisticated AI tools, stealthy threat actors can craft campaigns “at mass scale,” said Caulfield. They will initially use phishing to access a user’s primary credential, then employ AI-based outreach to trick them into sharing a second credential or take action that allows attackers into their account. 

Or, attackers will spam the secondary MFA SMS or push notification method causing “MFA fatigue,” when the user eventually gives in and pushes “allow.” Threat actors will also prime victims, making situations seem urgent, or fool them into thinking they’re getting legitimate messages from an IT help desk.

With man-in-the-middle attacks, meanwhile, an attacker can intercept a code during transmission between user and provider. Threat actors may also deploy tools that mirror login pages, tricking users into providing both their passwords and MFA codes.

Enter passwordless

The downfalls of MFA have prompted many enterprises to adopt passwordless methods such as passkeys, device fingerprinting, geolocation or biometrics. 

With passkeys, users are authenticated through cryptographic security “keys” stored on their computer or device, explained Derek Hanson, VP of standards and alliances at Yubico, which manufactures the widely-used YubiKey device. 

Each party must provide evidence of their identity and communicate their intention to initiate authentication. Users can sign into apps and websites with a biometric sensor (such as a fingerprint or facial recognition), PIN or pattern. 

“Users are not required to recall or manually enter long sequences of characters that can be forgotten, stolen or intercepted,” said Hanson. This reduces the burden on users to make the right choices and not hand over their credentials during a phishing attempt.

“Approaches like device fingerprinting or geolocation can supplement traditional MFA,” explained Anders Aberg, director of passwordless at Bitwarden. “These methods adjust security requirements based on user behavior and context — such as location, device or network — reducing friction while maintaining high security.”

The tandem use of devices and biometrics is on the rise, Caulfield agreed. At initial sign-in and verification, the user shows their face along with physical identification such as a passport or driver’s license, and the system performs 3D mapping, which is a sort of “liveness check.” Once photo IDs are confirmed with government databases, the system will then register the device and fingerprint or other biometrics. 

“You have the device, your face, your fingerprint,” said Caulfield. “The device trust piece is much more prevalent as the new silver bullet for preventing phishing and AI-based phishing attacks. I call it the second wave of MFA. The first wave was the silver bullet until it wasn’t.”

However, these methods aren’t completely foolproof, either. Hackers can get around biometrics tools by using deepfakes or by simply stealing a photo of the legitimate user. 

“Biometrics are stronger than passwords, but once compromised they are impossible to change,” said Steinberg. “You can change your password if needed, but did you ever try to change your fingerprint?”

Leveraging analytics, creating a failsafe

Caulfield pointed out that organizations are incorporating analytics tools and amassing mountains of data — yet they’re not putting it to use to bolster their cybersecurity. 

“These tools generate a ton of telemetry,” said Caulfield, such as who is signing in, from where and on what device. But they’re then “sending that all into a black hole.” 

Advanced analytics can help with identity threat detection and analytics, even if after the fact to provide a “stopgap or failsafe” when attackers bypass MFA, he said. 

Ultimately, enterprises must have a fail-safe strategy, agreed Ameesh Divatia, co-founder and CEO at data privacy company Baffle. Personally identifiable information (PII) and other confidential data must be cryptographically protected (masked, tokenized or encrypted). 

“Even if you have a data breach, cryptographically protected data is useless to an attacker,” said Divatia. In fact, GDPR and other data privacy laws don’t require companies to notify affected parties if cryptographically protected data gets leaked, because the data itself is still secure, he pointed out.

“Fail safe just means that when one or more of your cybersecurity defenses fail, then your data is still secure,” said Divatia. 

There’s a reason it’s called ‘multifactor’

Still, that’s not to say that MFA is completely going away. 

“In the entire scheme of things, the hierarchy of authentication starts with MFA, as weak MFA is still better than not having it at all, and that shouldn’t be overlooked,” said Dickson. 

As Caulfield pointed out, it’s called multi-factor authentication for a reason — “multi” can mean anything. It can ultimately be a mix of passwords, push notifications, fingerprint scans, physical possession of a device, biometrics or hardware and RSA tokens (and whatever evolves next). 

“MFA is here to stay, it’s just the definition now is ‘How good is your MFA’? Is it basic, mature or optimized?,” he said. However, in the end, he emphasized: “There’s never going to be a single factor that in and of itself is completely secure.”