7.3 Vulnerabilities of Legacy Multi-Factor Authentication
SMS: A Phone Number Is a Reclaimable Identifier
An SMS one-time code authenticates possession of a telephone number — and numbers are portable, recyclable, and transferable by customer-service request. In a SIM-swap attack the attacker calls or chats with the carrier’s support desk, impersonates the subscriber with name, address, and last four of a SSN bought for a few dollars on breach markets, and requests number portability to a SIM the attacker holds. Every OTP now routes to the criminal’s handset. Legacy SS7 signaling flaws additionally allow interception of SMS across networks, and recycled numbers get reassigned to strangers while old accounts still trust them. Even without any of that, a one-time code is still a shared secret — a real-time phishing relay can simply forward the prompt to the victim and replay the answer within its validity window.
Push Approvals: The Fatigue Attack
Push-based MFA sends “Is this you? Approve/Deny” to a phone app. Prompt bombing spams that prompt dozens or hundreds of times — at 2 a.m., wearing down, or after a pretext text claiming the account is under attack — until the user taps approve just to make it stop. Approvals without number matching are also blind: the prompt says nothing about what is being signed, so a session-relay attacker who already has the password needs only one compliant tap, and in adversarial-man-in-the-middle proxy setups the victim’s approval completes the attacker’s session live.
KBA: Secrets the Data Brokers Already Have
Knowledge-based authentication — mother’s maiden name, first school, street you grew up on — is a static, reusable secret whose answer set is public record: marriage indices, property deeds, credit-header data, and the 2017-scale breach dumps that put 145 million such records in circulation. Worse, help-desk pretexting exploits the same answers: one social-engineered call to an IT service desk “verifies” identity via KBA and resets the password, the MFA enrollment, or the recovery email in one ticket — the human lane bypassing every technical control at once.
The Common Root Cause
All three factors fail the same test: they authenticate a transferable channel (a number, a notification pipe, a trivia set) with a secret that can be phished, relayed, or reset by humans. That is precisely what origin-bound public-key factors in 7.4 are designed to eliminate.
Architecture Diagram
Key Takeaways
- SMS codes authenticate a phone number, and numbers are transferable via carrier pretexting (SIM swap / port-out).
- OTP codes are still phishable shared secrets: real-time relay proxies harvest them inside the validity window.
- Push MFA falls to fatigue attacks — spam the prompt until the human approves; number matching is the minimum patch.
- KBA answers live in public records and breach dumps, so quiz questions authenticate no one.
- The help desk is the softest door: one pretexted call resets password, factors, and recovery paths at once.