Your help desk can reset anyone’s MFA
The MGM attack reportedly began with a phone call to the IT help desk. Fix how resets are verified.
The attack that shut down slot machines and hotel check-ins at MGM Resorts this month reportedly started with a phone call. The attackers found an employee on LinkedIn, called the IT help desk pretending to be them, and got access reset. Last month Okta warned its customers about exactly this trick.
Your MFA is only as strong as the process for resetting it. If a confident voice and a name from LinkedIn are enough, the attacker doesn’t need to break anything.
Fix the process:
- Verify with something an attacker can’t look up: a video call with ID, a call back to the number on file, or approval from the person’s manager.
- Extra checks for admins. Resets for privileged accounts need two people.
- Notify the user through another channel every time their password or MFA is reset.
- Watch for new MFA devices registered right after a reset, especially on admin accounts.
- Give the help desk permission to say no, and back them when they do.
Help desk staff are trained to help. Attackers count on that.