Add MFA Attack Patterns and Mitigations with authoritative references - #2290
Add MFA Attack Patterns and Mitigations with authoritative references#2290sujalavnelavai wants to merge 12 commits into
Conversation
…erences Adds a new section, “Modern MFA Attack Patterns and Mitigations,” documenting current MFA attack techniques and recommended defenses based on guidance from NIST, CISA, OAuth, and the FIDO Alliance. This update includes: - MFA fatigue (push bombing) with mitigations and references - Real-time phishing (Adversary-in-the-Middle) with mitigations and authoritative URLs - SIM swap and phone number takeover with NIST/CISA references - Token theft and session hijacking with RFC 9700 and OWASP references - Device binding bypass with WebAuthn and FIDO specifications - MFA downgrade attacks with OAuth BCP references All attack patterns now include authoritative URLs to meet OWASP documentation standards and resolve missing-reference issues noted in prior reviews.
changed the URL for Phishing resistant CISA link
Added URL for Phishing resistant MFA CISA reference.
Added URL for implementing phishing resistant MFA CISA document.
Added URL for implementing phishing resistant MFA CISA document under SIM Swap.
Rectified mark down lint error and added URL links to implementing phishing resistant MFA CISA document.
Rectified mark down lint error.
| - If compromised, biometric data can be difficult to change. | ||
| - Hardware may be vulnerable to additional attack vectors. | ||
|
|
||
| ## Modern MFA Attack Patterns and Mitigations |
There was a problem hiding this comment.
I would drop "Modern"
| - [NIST SP 800-63B](https://pages.nist.gov/800-63-4/sp800-63b.html) | ||
| - [CISA – Implementing Phishing-Resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf) | ||
|
|
||
| ### Real-Time Phishing (Adversary-in-the-Middle) |
There was a problem hiding this comment.
I thins that "Adversary-in-the-Middle" and "Reverse-proxy" may be somewhat misldeading: this is not about MITM the TLS session here. Maybe focus on "Phishing" / "Faking" the target website?
| #### Mitigations | ||
|
|
||
| - Avoid SMS or voice-based MFA for privileged or high-value accounts. | ||
| - Prefer phishing-resistant authenticators (FIDO2/WebAuthn). Where these are not available, TOTP authenticator applications provide stronger protection than SMS or voice-based OTP. |
There was a problem hiding this comment.
Would adding a ref to TOTP be useful ? (https://datatracker.ietf.org/doc/html/rfc6238)
| - [NIST SP 800-63](https://pages.nist.gov/800-63-4/) | ||
| - [CISA – Implementing Phishing-Resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf) | ||
|
|
||
| ### Token Theft and Session Hijacking |
There was a problem hiding this comment.
I'm not sure I would count this as an attack against MFA. I would juste remove this part.
|
|
||
| - Disable legacy authentication protocols and endpoints that cannot enforce modern MFA requirements. | ||
| - Prevent fallback from phishing-resistant authenticators to lower-assurance authentication methods unless explicitly authorized. | ||
| - Follow OAuth 2.0 Security Best Current Practice when implementing OAuth-based authentication flows. |
There was a problem hiding this comment.
This entry is very vague. I'm not sure how this is relevant for this particular topic "MFA downgrade".
Made changes to the sections under MFA attack patterns and mitigations and added some references like TOTP following the maintainer's review.
|
Hello @randomstuff , I have made changes following your review and feedback. If there is any requirement for further changes, please let me know. Removed token theft and sessions hijacking completely as per your feedback. Thank you. |
sujalavnelavai
changed the title
mackowski
left a comment
mackowski
left a comment
There was a problem hiding this comment.
Thanks for this — it's a genuinely useful addition, it's on the right sheet, and your sources check out (all seven resolve and are authoritative). Before we can merge, a few changes:
Must-fix
- The new heading is indented two spaces (
## MFA Attack Patterns…), which makes Markdown render it inside the preceding biometrics bullet list rather than as a section — please dedent it to the start of the line. (This slips past markdownlint but breaks the section hierarchy and TOC.) - Please move the whole section out of the middle of the authentication-factor taxonomy (it currently sits between "Something You Are" and "Somewhere You Are") to after the factor sections — next to "Adaptive or Risk-Based Authentication" or just before "References and Further Reading".
- The SIM-swap subsection repeats guidance the sheet already gives in the SMS/Phone Calls section (the NIST 800-63B-4 "restricted authenticator" note and the SIM-swap con). Please trim it to the attack-pattern framing and link to
#sms-messages-and-phone-callsinstead of re-deriving it. - In the SIM-swap references,
pages.nist.gov/800-63-4/is the suite landing page and doesn't itself contain the SMS/voice guidance — please point it athttps://pages.nist.gov/800-63-4/sp800-63b.html.
Worth tightening
- "Prefer FIDO2/WebAuthn" appears as a mitigation in almost every subsection — state it once as the primary phishing-resistant control (linking the existing Passkeys section) and keep each subsection to what's unique to that attack.
- MFA fatigue: add rate-limiting/capping push prompts alongside number matching.
- Two mitigations name a goal without a how — "monitor anomalous activity" (name signals like impossible-travel / new-device token reuse) and "hardware-backed non-exportable keys / validate attestation" (name platform authenticators, TPM, Secure Enclave).
- Consider folding the five per-attack "References" blocks into inline links or the sheet's single References section.
- Scope the RFC 9700 bullet to OAuth protocol-level downgrade/mix-up (it doesn't govern authenticator-assurance downgrade).
- Minor: add
This PR fixes issue #2289, hyphenate "real-time", and define CISA on first use.
The security content itself is accurate and current — these are about structure, deduplication, and precision. Looking forward to the update.
Moved the entire MFA attack patterns and mitigations to the last of the MFA cheat sheets and committed changes as per maintainer's feedback.
Rectified mark down lint error.
|
Hello @mackowski , Thanks for your detailed feedback and guidance. I have fixed the changes you suggested and moved the entire MFA attack patterns as the last section of MFA cheat sheet. Checked the URLS ones again to confirm whether they are working. My thought is to consolidate MFA attack patterns references to the original MFA cheat sheet references, because the references heading seems duplication and occupies the space of the cheat sheet. But I need your approval and feedback for this to do. If there are any changes to fix please let me know. Thank you ones again. |
Updated changes suggested in the review.
|
Hello @mackowski . I did not notice this line which you have suggested before " Consider folding the five per-attack "References" blocks into inline links or the sheet's single References section." Now I have consolidated the references into one section as per your suggestion. Thank you. |
4 participants
This pull request adds a new "MFA Attack Patterns and Mitigations" section to the Multifactor Authentication Cheat Sheet.
The new section provides practical guidance on modern MFA-related threats where attackers target authentication workflows, user behavior, or supporting infrastructure rather than attempting to directly break MFA mechanisms.
Changes Made
Added coverage for the following MFA attack patterns:
Each attack pattern includes:
Rationale
MFA adoption has increased significantly, but attackers increasingly target weaknesses around:
This addition helps practitioners understand common MFA attack paths and apply appropriate mitigations, including:
The focus is on attacker behavior and mitigation strategies rather than vendor-specific implementations.
References
Guidance is based on:
Testing
You're A Rockstar
Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.
Please make sure that for your contribution:
[TEXT](URL)Scope and sourcing (required)
[text](URL).If your PR is related to an issue, please finish your PR text with the following line:
This PR fixes issue #
2289.AI Tool Usage Disclosure (required for all PRs)
Please select exactly one of the following options. PRs that leave this section blank will be closed.
the contents and I affirm the results. The LLM used is
Microsoft Copilot and ChatGPT to help draft and refine wording. All technical content, references, and mitigations were manually reviewed and validated for technical accuracy and the prompt used isRefine the content I wrote into OWASP Cheat Sheet style, improve clarity, and ensure consistent formatting while keeping all technical details intact`. I have independently verified every citation and technical claim against the cited source. [Feel free to add more details if needed]Thank you again for your contribution 😃