Old Dominion University is being targeted by phishing attacks exploiting the DUO mobile app. ODU uses a two-factor authentication system to verify a user’s identity when logging into ODU’s online services. Multi-factor authentication utilizing smartphones adds a layer of security for students and faculty, but it opens the door for different kinds of cyber-attacks like “prompt-bombing”. 

“Prompt-bombing” involves flooding targets with authentication requests using mobile phones. This is done in the hopes that a user will fail to differentiate between the “real” request and the “fake” ones, thereby accepting a false request and granting an attacker access.

“No legitimate business would communicate to customers in a manner that comes close to “prompt-bombing,” said ODU IT Services.

If you receive a DUO prompt when you are not actively prompting DUO Mobile to access an ODU service, press “No” and change your MIDAS password. If you accidentally select “Yes”, report the incident to [email protected], and then go and change your password. These cyber-attacks give access to credentials and allow use of targeted accounts.

Alternatively, another approach has been to send multiple “fake” login requests around the time when actively authenticating, hoping to ensnare users that way. Checking timestamps on the verification requests to ensure that the correct request is being authenticated is paramount.

The rise in prompt-bombing attacks comes because of multi-factor authentication’s growing use and popularity. A famous incident involving this type of cyber-attack was the recent SolarWinds cyber-attack in early 2020 that granted Russian hackers access to a massive amount of sensitive information.

Protect yourself and your information by ensuring that all DUO Mobile prompts are legitimate before confirming authentication. 

For any additional questions regarding cybersecurity awareness and prevention, visit www.odu.edu/safecomputing.