facebook linkedin twitter

Computerware Blog

Phishing Attacks Are Besting Two-Factor Authentication--Now What?

Phishing Attacks Are Besting Two-Factor Authentication--Now What?

What has proven to be one of the more effective ways of preventing phishing attacks may be under fire from more advanced threats designed specifically to penetrate the defenses of two-factor authentication. This means that users need to be more cognizant of avoiding these attacks, but how can you help them make educated decisions about this? Let’s start by discussing the phishing attacks that can beat 2FA.

How Has Two-Factor Authentication (2FA) Been Defeated?

There are several methods used by hackers to bypass the security benefits of 2FA. Some phishing attempts have managed to find success in convincing users to have over both their credentials and the 2FA code that is generated by a login attempt. As reported by Amnesty International, one group of hackers has been sending out phishing emails that link the recipient to a convincing fake page to reset their Google password. Sometimes fake emails can be quite convincing, making the trickery much more difficult to identify.

As Amnesty International looked into the attacks, they found that the attacks were using an automated solution to launch Chrome and submit information the user entered into their end. This meant that the 30-second time limit imposed by 2FA was of no concern.

In November 2018, an application on a third-party app store posed as an Android battery utility tool was found to be stealing funds from a user’s PayPal account. The application would change the device’s Accessibility settings to enable an accessibility overlay feature. Once it was in place, the user’s clicks would be mimicked, giving hackers the ability to send funds to their own PayPal account.

Yet another method of attack was shared publicly by Piotr Duszynski, a Polish security researcher. This method, named Modlishka, created a reverse proxy that intercepted and recorded credentials as the user attempted to plug them into an impersonated website. Modlishka would then send the credentials to the real website to hide the fact that the user’s credentials were in fact stolen. Even worse yet, if the person using Modlishka is nearby, they can steal the 2FA credentials and use them very quickly.

Protect Yourself Against 2FA Phishing Schemes

The first step toward preventing 2FA phishing attacks is to make sure you actually have 2FA implemented in the first place. While it might not seem like much of a help (after all, these attacks are designed to work around them), it is much preferable to not having 2FA at all. The most secure method of 2FA at the moment uses hardware tokens with U2F protocol. Most important of all, however, is that your team needs to be trained on the giveaway signs of phishing attacks. With these attempts that target 2FA solutions, it might not be immediately apparent, which is why it’s all the more important to remain vigilant.

At its heart, 2FA phishing is just like regular phishing, plus an additional step to bypass or replicate the secondary authentication method. Here are a few tips to ensure best practices are followed regarding phishing attempts:

  • First, check to make sure that the website you’re using is actually the one it claims to be. For example, if you’re logging in to your Google account, the login URL wouldn’t be something like logintogoogle.com. You wouldn’t believe how often spoofers will fool users in this way.
  • To help you better understand other signs of phishing attacks, check out this phishing identification skills quiz by Alphabet, Inc. We encourage your staff also look into it.

To learn more about phishing attacks, be sure to subscribe to our blog.

Tip of the Week: Using Cloud Services for Your Bus...
Interpreting Analytics Isn’t Always Cut and Dry
 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Thursday, April 18, 2019

Captcha Image

Mobile? Grab this Article!

QR-Code dieser Seite

Tag Cloud

Security Tip of the Week Technology Best Practices Privacy Internet Cloud Business Computing Software Hackers Business Management Microsoft Data Workplace Tips Backup Managed Service Provider Productivity Hardware Network Security Business Email Saving Money Malware Hosted Solutions IT Services Efficiency Google IT Support Small Business User Tips Computer Mobile Devices Smartphones Quick Tips Innovation Business Continuity Gadgets VoIP Microsoft Office Disaster Recovery Network Android Social Media Productivity Data Backup Collaboration Communication Mobile Office Virtualization Smartphone Server Mobile Device Management communications Data Recovery Miscellaneous Upgrade Windows 10 Tech Term Cybersecurity IT Support Ransomware Unified Threat Management Windows Phishing Remote Monitoring Vendor Management Passwords Facebook Holiday Operating System Managed IT services Mobile Computing Analytics Apps Automation BYOD Remote Computing Users WiFi BDR Apple Mobile Device Data Management The Internet of Things Outsourced IT Internet of Things Marketing Firewall History Artificial Intelligence App Save Money Alert Browser Managed IT Services Cloud Computing Encryption Big data IT Consultant Printer Content Filtering Windows 10 Going Green Health Spam Office 365 Bring Your Own Device Antivirus Two-factor Authentication Gmail Bandwidth Office Maintenance Cybercrime Virus Tech Support Information Technology Lithium-ion Battery Best Practice Cost Management Hiring/Firing Training Hard Drives Help Desk Budget Wireless Technology Outlook Saving Time Windows 8 Search Business Technology Managed IT Update Employer-Employee Relationship Hacking IBM Money Phone System Document Management Healthcare Access Control Computers VPN It Management Travel Education Blockchain Recovery iPhone Risk Management Legal Save Time Networking Information Regulations Augmented Reality PowerPoint Proactive IT SaaS Running Cable File Sharing Customer Service Administration Law Enforcement Applications Hard Drive Intranet Twitter Government Compliance Managed Service Mobility Website Data storage Humor Scam Black Market Flexibility Word Retail Cryptocurrency Data Breach Laptop Business Growth Value Business Intelligence Password Cortana Excel Digital Digital Payment Project Management Telephony Hacker Websites Router Downtime Management Customer Relationship Management Machine Learning Paperless Office Vulnerabilities Telephone Systems Comparison Tablet Current Events Sports Company Culture Disaster User Computing Computer Repair Hosted Solution End of Support Social Networking Social Robot Wireless Data Security Securty Fax Server Google Maps DDoS Patch Management Solid State Drive Data Loss Social Engineering Avoiding Downtime Chromebook Computing Infrastructure Hack Voice over Internet Protocol Redundancy How To eWaste Google Docs Net Neutrality Pain Points Monitoring Experience Chrome Download Evernote Private Cloud Monitors Virtual Assistant Cleaning Office Tips Start Menu Tech Terms Computer Accessories Microchip Taxes Processors Distributed Denial of Service USB Mobile Technology YouTube User Error Trending Co-managed IT Presentation Gaming Console Cooperation Software as a Service Unified Communications Settings Vendor Uninterrupted Power Supply Mouse Public Cloud Virtual Desktop Webcam Specifications Safety Text Messaging Vulnerability Identity Theft Statistics Bitcoin Programming Documents Data Protection Windows 7 IT service Network Congestion Lifestyle Heating/Cooling Distribution Entertainment Virtual Reality Politics Storage Inbound Marketing Emails Bluetooth Streaming Media Conferencing Automobile Software License Trends Motion Sickness Best Available Keyboard Tech Leadership Assessment SharePoint Product Reviews Multi-Factor Security Cost Scalability Microserver Adminstration Integration Pirating Information Read Fraud Tactics Fileless Malware Google Calendar Deep Learning Devices Messenger Tracking Domains Tip of the week Work/Life Balance Get More Done Proxy Server VoIP UTM Content Rental Service Meetings Public Speaking Modem Touchscreen News Visible Light Communication Memory Knowledge Device Management IT Plan Enterprise Resource Planning Web Server Printer Server Shortcut Term Consultation IT consulting Legislation Error Cabling Turn Key Electronic Medical Records Content Management email scam Addiction Wi-Fi Administrator Trojan Entrepreneur Directions Technology Tips Business Managemenet Accountants A.I. Books Workers Troubleshooting Recording Environment Dark Web Audit CIO Multi-factor Authentication Supercomputer Organize HIPAA Upselling SSID Fake News Advertising Flash Health IT Video Surveillance Staffing Google Wallet online Currency Migration Connected Devices Competition Processing Data Warehousing Windows XP Wireless Headphones Telephone Worker Electronic Payment Society Network Management Managed IT Service Saving ZTime Access Displays Equifax Fleet Tracking Reading Samsung Business Owner Logistics Emergency Hard Drive Disposal G Suite Bookmark Computer Care Micrsooft LinkedIn Device security MSP Employer Employee Relationship IP Address Microsoft Excel Human Resources Debate Drones Desktop Finance Hacks Physical Security Webinar Application Harddrive Google Play Google Drive Windows Server 2008 Nanotechnology Social Network Licensing Archive Business Cards Service Level Agreement Banking Botnet Processor Spyware Mobile Payment Skype Startup Asset Tracking Relocation Tablets GPS Microsoft 365 Unified Threat Management Backup and Disaster Recovery Sync External Harddrive Browsers Electricity Printing Username Medical IT Permissions Language User Tip Gamification Notifications CCTV Digital Signature Security Cameras Point of Contact Screen Reader Customer Resource management Music Piracy Upload Business Metrics Computer Malfunction Teamwork Navigation Thin CLient cache Television switches Writing Smart Tech Reliable Computing 3D Solutions Ebay Fiber-Optic Database In Internet of Things Best Practives Smart Phones Data Analysis WannaCry Downloads Upgrades HTML Professional Services PDF Corporate Profile Recycling Mobile Security GDPR Time Management Freedom of Information LiFi Analytic Telephone System CrashOverride Regulation 3D Printing Capital Productuvuty Printers Managing Stress

toner1