Stories
Slash Boxes
Comments

SoylentNews is people

posted by takyon on Monday December 17 2018, @01:33PM   Printer-friendly
from the phish-in-the-barrel dept.

Submitted via IRC for SoyCow1984

Iranian phishers bypass 2fa protections offered by Yahoo Mail and Gmail

A recent phishing campaign targeting US government officials, activists, and journalists is notable for using a technique that allowed the attackers to bypass two-factor authentication protections offered by services such as Gmail and Yahoo Mail, researchers said Thursday. The event underscores the risks of 2fa that relies on one-tap logins or one-time passwords, particularly if the latter are sent in SMS messages to phones.

Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with security firm Certfa Lab said in a blog post. The emails contained a hidden image that alerted the attackers in real time when targets viewed the messages. When targets entered passwords into a fake Gmail or Yahoo security page, the attackers would almost simultaneously enter the credentials into a real login page. In the event targets' accounts were protected by 2fa, the attackers redirected targets to a new page that requested a one-time password.

"In other words, they check victims' usernames and passwords in realtime on their own servers, and even if 2 factor authentication such as text message, authenticator app or one-tap login are enabled they can trick targets and steal that information too," Certfa Lab researchers wrote.

In an email, a Certfa representative said company researchers confirmed that the technique successfully breached accounts protected by SMS-based 2fa. The researchers were unable to confirm the technique succeeded against accounts protected by 2fa that transmitted one-time passwords in apps such as Google Authenticator or a compatible app from Duo Security "We've seen [it] tried to bypass 2fa for Google Authenticator, but we are not sure they've managed to do such a thing or not," the Certfa representative wrote. "For sure, we know hackers have bypassed 2fa via SMS."


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by shortscreen on Monday December 17 2018, @09:04PM

    by shortscreen (2252) on Monday December 17 2018, @09:04PM (#775556) Journal

    No. Emails can contain an image as base64 or an attachment, but that wouldn't allow spying by remote systems. What they are referring to is html email that references an image on a web server, which is then automatically loaded by an (idiotic) email reader. This story illustrates one of the reasons that automatically loading things from arbitrary web servers just to display an email is a terrible idea that should have died the same moment it was conceived.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2