Attacks/Breaches
11/9/2010
03:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researchers See Real-Time Phishing Jump

Two-factor authentication takes its toll on phishing, so attackers find ways around it, including SpyEye

Real-time phishing attacks that cheat two-factor authentication are on the rise around the globe as phishers adapt to the latest barriers put in their way, according to a team of researchers.

Researchers at Trusteer today said 30 percent of all attacks during the past two-and-a-half months against websites using two-factor authentication have been real-time, man-in-the-middle (MITM) methods that allow the attackers to bypass this stronger authentication. The data comes from a sampling of thousands of phishing attacks monitored by the researchers.

Phishing attacks typically are static, so they are mostly rendered powerless when a bank uses two-factor authentication, such as one-time passwords. That's because the attacker may be able to capture the first level of credentials, but they aren't able to easily capture and use OTPs, which quickly expire.

So phishers are adapting their attacks to find ways around stronger authentication, and security experts say it was only a matter of time until they routinely started cheating banks and other transactional sites' two-factor authentication. This type of real-time MITM attack has been isolated and rare thus far, experts say.

"This sort of thing is going to be on the rise because more banks are implementing two-factor and out-of–band authentication, so the phishers have no choice but to do this," says Nitesh Dhanjani, a senior manager at Ernst & Young and security expert.

Trusteer researchers have spotted these attacks in South Africa, Europe, and now in the U.S., says Mickey Boodaei, CEO of Trusteer. And while these attacks are not a new concept, this is the first time his team has seen them in such high numbers, he says. "We have seen them before in very small quantities," he says.

Meanwhile, researchers at M86 Security are seeing another trend in attacks on online bank transactions. Bradley Anstis, vice president of technology strategy with M86, says his team is seeing more activity from the SpyEye Trojan as Zeus gradually declines. "We're not seeing the phishing angle, but we are seeing U.S. banks being targeted with SpyEye," he says. They see more man-in-the-browser attacks taking over user sessions than starting off from a phishing site, he says.

Overall, phishing has been on the decline, especially with two-factor authentication now more commonly in the picture, he says. "We've certainly seen a pretty big drop-off in phishing sites in the last year or two. Two-factor has really cooled off phishing," Anstis says. "Now attackers are moving into taking over a user's actual session. They will wait until they log in rather than capture their usernames, etc."

Trusteer's Boodaei says in these latest real-time phishing attacks, the victims are initially lured to the site with a phishing email posing as their bank, with a phony link to the real-time phishing site. "So as the user tries to log on, the phishing site immediately pushes [their credentials] to the real website, so at the end of the process the fraudsters have an authenticated session with the bank," he says. "This is all taking place in real time."

When the victim gets his OTP via his cell phone, for example, he then types it into the phishing site, assuming all the while that he is on his bank's site. The attackers then use that number before it expires to finalize the authentication process and start their own session with the user's stolen credentials.

He says unlike some phishing gangs that are split into groups who steal credentials and those who buy them to commit the fraud, this attack is waged by a group that both steals the information and commits the fraud.

The underlying problem, meanwhile, is that two-factor authentication can be bypassed, according to security experts. "There are a lot of heads stuck in the sand assuming they are protected," M86's Anstis says.

Aside from locking down the browser, other defensive options include transaction-verification tools. "Two-factor authentication basically has nowhere to go ... to avoid fraudsters from logging onto victims' accounts," Trusteer's Boodaei says. "What banks and other organizations are doing are using various types of verification technology when they [the criminals] actually try to move money out of the account. That won't prevent criminals from logging into your account, but it may prevent them from moving money out."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

CVE-2014-6395
Published: 2014-12-19
Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.