2FA Immune Phishing Attacks Are on the Rise

2FA Immune Phishing Attacks Are on the Rise

2FA is more secure than single-factor methods only requiring a password, but it's not an impenetrable method.

People are used to two-factor authentication (2FA) security measures that bolster account protection. They require the account owner to provide something they know, as well as something they own.

For example, a person might get a text message containing a code that pops up on their smartphone. The password represents the knowledge aspect, and the code is the possession part.

Then, if a person's password somehow becomes compromised, the thief ideally wouldn't also have the smartphone text message.

That system sounds like a valid one, but experts warn hackers have even found a way to bypass the safeguards 2FA should provide.

A New Kind of Phishing

Nicolas Lidzborski, a security engineering lead at Google, mentioned the company had seen a substantial increase in 2FA phishing attacks. When speaking about the matter at a cybersecurity conference, he clarified that 2FA is more secure than single-factor methods only requiring a password, but it's not an impenetrable method.

How do hackers carry out these attacks? They use so-called "phishing kits" to create fake login pages people go to when they type in the 2FA code. After that, the cybercriminals may have to act quickly.

2FA codes typically only give access within small windows of time. Some are as long as 60 minutes. But, at Google, the codes become inactive in just 30 seconds. Automated platforms can use the 2FA code before it expires, though. If a hacker uses one of those, they could let those tools automatically wreak havoc on a victim by grabbing the information and using it to break into an account.

Like the lottery scammers that get phishing victims to divulge details by presenting them with links that go to phony login screens or forms, the people who orchestrate 2FA attacks may painstakingly create the pages that capture a victim's details, going to substantial lengths to ensure aspects like the font or graphics seem authentic.

Considering that the people received legitimate 2FA codes shortly before typing them in, most individuals wouldn't stop to think about how the forms might be fake. Indeed, this is a relatively new issue that hasn't reached mainstream consciousness yet.

A Security Researcher Makes a Tool to Bypass 2FA

Eventually, people may look back on 2019 as the year when people realized 2FA is not a foolproof method. In early January, news broke about a security researcher who created a penetration testing tool showing the potential ineffectiveness of 2FA. It's a modified reverse proxy that records all a phishing victim's interactions and traffic as they enter details into a login screen.

This example describes the phishing kits explained earlier. But, its creator says it's easier to implement and automate than other available options. If tools like this one become widely available to cybercriminals, it'd potentially become much easier for people to fool phishing victims, despite having limited tech knowledge.

Even worse, the fake forms people enter information into could seem so realistic that it becomes virtually impossible for everyday internet users to detect any oddities about them.

Advancements in 2FA

These developments illustrate why it's time for 2FA to develop beyond the method of text message codes. Fortunately, the evolution is ongoing. Some more advanced forms of 2FA send push notifications to mobile devices.

Additionally, cases exist where the second element if 2FA is not something people have, but something they are. For example, someone might fulfill the latter component of 2FA by pressing on a biometric fingerprint reader embedded in their smartphone.

Once a user interacts with those notifications, access gets granted. This method reportedly doesn't produce anything a hacker could steal. It's convenient for the user, too, because they don't need to type anything in to access the site or service. That's good news, especially since the databases maintained by the third-party companies that verify users' phone numbers and send 2FA text message codes have flaws, too.

One of those companies, called Voxox, had a database vulnerability that exposed at least 26 million text messages to a security researcher who was able to see the outgoing text messages almost in real time. Voxox took the database offline, but the event emphasizes another reason why people shouldn't blindly believe 2FA will protect them from hacks in all cases.

Hackers Continually Seek New Attack Methods

This coverage serves as a reminder that hackers keep pace with security developments and find ways to make them less effective.

Security researchers sometimes find the issues before hackers do, but people need to exercise caution nevertheless and remember how creative hackers are when they trick victims.

Featured

  • New Gas Monkey Garage Venue Uses AI-Enhanced Video Technology

    Gas Monkey Garage, the automotive custom shop and entertainment brand founded by Richard Rawlings of Fast N’ Loud TV fame, has opened a vibrant new restaurant and bar in South Dakota, equipped with advanced, AI-enhanced video tech from IDIS Americas. Read Now

  • Data Driven, Proactive Response

    As cities face rising demands for smarter policing and faster emergency response, Real Time Crime Centers (RTCCs) are emerging as essential hubs for data-driven public safety. In this interview, two experts with deep field experience — Ross Bourgeois of New Orleans and Dean Cunningham of Axis Communications — draw on decades of operational, leadership and technology expertise to share how RTCCs are transforming public safety through innovation, interagency collaboration and a relentless focus on community impact. Read Now

  • Integration Imagination: The Future of Connected Operations

    Security teams that collaborate cross-functionally and apply imagination and creativity to envision and design their ideal integrated ecosystem will have the biggest upside to corporate security and operational benefits. Read Now

  • Smarter Access Starts with Flexibility

    Today’s workplaces are undergoing a rapid evolution, driven by hybrid work models, emerging smart technologies, and flexible work schedules. To keep pace with growing workplace demands, buildings are becoming more dynamic – capable of adapting to how people move, work, and interact in real-time. Read Now

  • Trends Keeping an Eye on Business Decisions

    Today, AI continues to transform the way data is used to make important business decisions. AI and the cloud together are redefining how video surveillance systems are being used to simulate human intelligence by combining data analysis, prediction, and process automation with minimal human intervention. Many organizations are upgrading their surveillance systems to reap the benefits of technologies like AI and cloud applications. Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.