Slashdot Mirror
Iranian Phishers Bypass 2fa Protections Offered By Yahoo Mail, Gmail (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: A recent phishing campaign targeting U.S. government officials, activists, and journalists is notable for using a technique that allowed the attackers to bypass two-factor authentication protections offered by services such as Gmail and Yahoo Mail, researchers said Thursday. The event underscores the risks of 2fa that relies on one-tap logins or one-time passwords, particularly if the latter are sent in SMS messages to phones.
Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with security firm Certfa Lab said in a blog post. The emails contained a hidden image that alerted the attackers in real time when targets viewed the messages. When targets entered passwords into a fake Gmail or Yahoo security page, the attackers would almost simultaneously enter the credentials into a real login page. In the event targets' accounts were protected by 2fa, the attackers redirected targets to a new page that requested a one-time password. "In other words, they check victims' usernames and passwords in realtime on their own servers, and even if 2 factor authentication such as text message, authenticator app or one-tap login are enabled they can trick targets and steal that information too," Certfa Lab researchers wrote. "We've seen [it] tried to bypass 2fa for Google Authenticator, but we are not sure they've managed to do such a thing or not," the Certfa representative wrote. "For sure, we know hackers have bypassed 2fa via SMS."
Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with security firm Certfa Lab said in a blog post. The emails contained a hidden image that alerted the attackers in real time when targets viewed the messages. When targets entered passwords into a fake Gmail or Yahoo security page, the attackers would almost simultaneously enter the credentials into a real login page. In the event targets' accounts were protected by 2fa, the attackers redirected targets to a new page that requested a one-time password. "In other words, they check victims' usernames and passwords in realtime on their own servers, and even if 2 factor authentication such as text message, authenticator app or one-tap login are enabled they can trick targets and steal that information too," Certfa Lab researchers wrote. "We've seen [it] tried to bypass 2fa for Google Authenticator, but we are not sure they've managed to do such a thing or not," the Certfa representative wrote. "For sure, we know hackers have bypassed 2fa via SMS."
So they hacked a phone and snooped SMS. Cool. You're not scaring me.
I love face 2 ass!
We just need 3FA. Adding yet another insecure element into the mix will surely lead to security!
Don't load images by default.
Don't click links in emails. Instead type the website into the browser.
Don't enter a 2 factor authentication code into a website without checking the URL.
Why are we still trusting unsecured, unsigned emails for anything other than a likely-spam folder?
So you're saying if I was dumb as a brick and couldn't notice I wasn't actually on the right website, someone could get access to my stuff!? No way!
It is delicious!
The liFIDO / U2F systems (aka the little usb/wireless tokens) were not compromised by this attack! Yay technical security advance!
We really could use less all-over-the-map branding for U2F .. is called FIDO, FIDO2, Atlas? In fact many times it's called "Yubikey" which is pretty wrong.
What's great about U2F is that the user can be directed to the phishing, site and click the login button on the token and .. nothing bad happens. The system does not depend on the user for vigilance.
Scared of those pesky Russian trolls, Chinese spies, and Iranian cyber-terrorists! Don't fear, CISA is here! The DHS Cybersecurity and Infrastructure Security Agency stands ready to take tax payer money and spend it on bureaucrats to go on junkets for to Europe...er, we mean, on releasing advisories that are at least a week old and are rehashes of what's been published by private sector companies..., err, I mean...can we get back to everyone on that?
2FA that ask you to enter a code on the same page you sign in are silly for this reason. They offer zero protection if you're dumb enough to fall for a fake page or someone get haxored well enough for a MITM to happen.
When I sign into gmail my phone prompts me and I unlock it then it signs in automatically no further intervention I only enter username/password in the browser. You would need to hit my phone and browser to have a chance of doing anything.
Performing a MITM attack allows you to be a
Man in the (Middle)! What will these Iranian A-rabs think of next!>!>
Virtually impossible to phish
the fact they watch for email being read wont work for plain txt, gmail even for HTML loads the images into the gmail cache on receipt so you cant tell when the person reads the email (you have to use the gmail apps though) you should use plain text if possible.
so basically this is a phishing scheme linked to SMS messages and wont work with the google authenticator or yahoo 2FA nor will it work with apple 2FA
your more at risk if you dont secure your domain... the number of domains that do not have DNSSEC is quite scary... combined with the amount of mail servers that actually verify the certificates correctly via DANE
you can test your domain https://www.internet.nl/
Thankfully the German and Netherlands Governments have made DANE a standard for secure email communications... the American gov also MUST have DNSSEC enabled...
so test and secure your corporate domain today !
regards
John Jones
IP's can be faked just like democrat party faked russia ips for collusion hoax.
The premise of multi factor security is that the authentication is performed in a way that guarantees each factor is an orthogonal channel. Ie. Something you know (ie. information), something you have (a physical device), and something you are (your physical body).
Sending something out of band to a user (or getting them run App that generates that something), that they then enter and send down the same authentication channel as the password is still single factor. Same applies to a photo of the user when a remote server is taking the picture with a remote 'camera' that is not under its secure control.
The issue is that anyone that hijacks the connection (either with a mistyped/phished link, or more a sophisticated interception/trojan attack), can run a simultaneous session so the user sees a facsimile of the real site and performs all security requests to enter data along the same channel. Since the channel is hijacked, the attacker just runs a parallel session where they enter all the same data as the user in the real session, while the user enters data into the fake channel (including SMS codes, google authenticator codes, whatever).
This reduces these techniques to a single factor 'something you know'. Even though some of that data is recreated at the last second (OTPs/codes) and then combined with longer term unchanging values such as password/userid/etc, it is still just a single use 'something you know', albeit something you only knew for a short time, and the knowledge is now longer useable.
Even though these banking style faux 2FA systems are still just a single factor, One Time Passwords (OTPs) are an improvement over a single long term password as they are a single use 'something you know'. So they prevent an attacker having repeated access. OTPs can be known through a device (FOB), an App (Authenticator), an SMS message, or even a series of passwords or an algorithm you've memorised that allows the OTP to never be repeated. These hardware/software based '2nd factor' systems are simply memory boosters so you don't have to memorise anything complicated, or multiple single use codes. Some people call this 'two factor', but the authentication path still reduces to 'something you know' since with 'you' as proxy, at the time of entry, it is still clearly only 'something you know', and no longer 'something you have'. It is something you know, that I could come to know remotely, even if just for a single use, without having access to your 'something you have'.
True 2FA 'something you have' would require the browser authenticate through your 'authenticator device' where the device is verifying the communications path and data that the user is entering into it. True 3FA would have you enter a secure environment with the first two factors, then use securely controlled scanner(s) to verify that your physical body or a perfect facsimile is being scanned.
Who the fuck are they? A quick search shows nothing, spook front?
2FA better authenticates the user. It doesn't authenticate the service. That's still up to the user to do adequately, and if they fail the entire system breaks down.
Provided that you do not actually send them to the server and use them properly.
Secure Remote Passwords is totally secure from MIM attacks, as wall as being totally secure against bad CAs. It uses the password to generate the shared secret.
And due to some extreme cleverness in the algorithm, is even secure against weak passwords.
So why don't we use it! Because it would put most of the security industry out of business? Or pure ignorance.
https://en.wikipedia.org/wiki/...
(It does require browser support, not JavaScript that just promises not to send the password over.)
If you're working in security and using an email client that renders HTML then screw you - you deserve everything you get.
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
This is why you need to authenticate the server first, to make sure nobody took control of the dns etc.
The certificates scammers buy can present same name as original using earlier tricks in text representation. "Oreo Bank INC" vs "0reo Bank INC" is the simplest...
If this is not done the rest is meaningless.
HTTPS: yep
Certificate "0reo Bank INC": Umm, yes???
TFA: Wasted time
So, weirdly, this is also an issue with steam. Steam uses 2FA in the form of an app (mobile authenticator). This is used to secure your account. This matters because some people have accounts worth thousands of dollars (yes, in non-physical digital items). A few people have accounts worth more, multiple thousands of dollars (in an unrelated incident, check /r/vac_porn where two unrelated users with accounts worth multiple hundred(!) thousand dollars were vac banned earlier this week, rendering those items untradable and worthless).
That's just a preface to point out there is money to be made by scamming people out of account items. And recently, there has been a rising number of sophisticated scam websites. These sites basically operate the same as outlined in the article summary, but it's all automated. You visit a fake site that looks exactly like the official steam login page and enter your credentials; the fake website server uses this to actually authenticate you with steam. Then there's the standard popup asking for your steam 2FA code. Once again, the website just presents a front and passes that along. To the end user, it looks like a regular login, but now the fake website has (limited) access to your account. There are still some protections against what new ip address logins can do, but this is the critical first step in a new sophisticated scam. There's a detailed write up by a mod stickied at the top of /r/globaloffensivetrade if you want more info