2FA Immune Phishing Attacks Are on the Rise

2FA Immune Phishing Attacks Are on the Rise

2FA is more secure than single-factor methods only requiring a password, but it's not an impenetrable method.

People are used to two-factor authentication (2FA) security measures that bolster account protection. They require the account owner to provide something they know, as well as something they own.

For example, a person might get a text message containing a code that pops up on their smartphone. The password represents the knowledge aspect, and the code is the possession part.

Then, if a person's password somehow becomes compromised, the thief ideally wouldn't also have the smartphone text message.

That system sounds like a valid one, but experts warn hackers have even found a way to bypass the safeguards 2FA should provide.

A New Kind of Phishing

Nicolas Lidzborski, a security engineering lead at Google, mentioned the company had seen a substantial increase in 2FA phishing attacks. When speaking about the matter at a cybersecurity conference, he clarified that 2FA is more secure than single-factor methods only requiring a password, but it's not an impenetrable method.

How do hackers carry out these attacks? They use so-called "phishing kits" to create fake login pages people go to when they type in the 2FA code. After that, the cybercriminals may have to act quickly.

2FA codes typically only give access within small windows of time. Some are as long as 60 minutes. But, at Google, the codes become inactive in just 30 seconds. Automated platforms can use the 2FA code before it expires, though. If a hacker uses one of those, they could let those tools automatically wreak havoc on a victim by grabbing the information and using it to break into an account.

Like the lottery scammers that get phishing victims to divulge details by presenting them with links that go to phony login screens or forms, the people who orchestrate 2FA attacks may painstakingly create the pages that capture a victim's details, going to substantial lengths to ensure aspects like the font or graphics seem authentic.

Considering that the people received legitimate 2FA codes shortly before typing them in, most individuals wouldn't stop to think about how the forms might be fake. Indeed, this is a relatively new issue that hasn't reached mainstream consciousness yet.

A Security Researcher Makes a Tool to Bypass 2FA

Eventually, people may look back on 2019 as the year when people realized 2FA is not a foolproof method. In early January, news broke about a security researcher who created a penetration testing tool showing the potential ineffectiveness of 2FA. It's a modified reverse proxy that records all a phishing victim's interactions and traffic as they enter details into a login screen.

This example describes the phishing kits explained earlier. But, its creator says it's easier to implement and automate than other available options. If tools like this one become widely available to cybercriminals, it'd potentially become much easier for people to fool phishing victims, despite having limited tech knowledge.

Even worse, the fake forms people enter information into could seem so realistic that it becomes virtually impossible for everyday internet users to detect any oddities about them.

Advancements in 2FA

These developments illustrate why it's time for 2FA to develop beyond the method of text message codes. Fortunately, the evolution is ongoing. Some more advanced forms of 2FA send push notifications to mobile devices.

Additionally, cases exist where the second element if 2FA is not something people have, but something they are. For example, someone might fulfill the latter component of 2FA by pressing on a biometric fingerprint reader embedded in their smartphone.

Once a user interacts with those notifications, access gets granted. This method reportedly doesn't produce anything a hacker could steal. It's convenient for the user, too, because they don't need to type anything in to access the site or service. That's good news, especially since the databases maintained by the third-party companies that verify users' phone numbers and send 2FA text message codes have flaws, too.

One of those companies, called Voxox, had a database vulnerability that exposed at least 26 million text messages to a security researcher who was able to see the outgoing text messages almost in real time. Voxox took the database offline, but the event emphasizes another reason why people shouldn't blindly believe 2FA will protect them from hacks in all cases.

Hackers Continually Seek New Attack Methods

This coverage serves as a reminder that hackers keep pace with security developments and find ways to make them less effective.

Security researchers sometimes find the issues before hackers do, but people need to exercise caution nevertheless and remember how creative hackers are when they trick victims.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Busy South Africa Building Integrates Custom Access Control System

    Nicol Corner, based in Bedfordview, Johannesburg, South Africa, is home to a six-star fitness club, prime office space, and an award-winning rooftop restaurant. This is the first building in South Africa to have its glass façade fully incorporate fritted glazing, saving 35% on energy consumption. Nicol Corner (Pty) LTD has developed a landmark with sophisticated design and unique architecture by collaborating with industry-leading partners and specifying world-class equipment throughout the project. This includes installing a high-spec, bespoke security and access control system. Read Now

  • Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

Featured Cybersecurity

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3