Attacks/Breaches
11/9/2010
03:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researchers See Real-Time Phishing Jump

Two-factor authentication takes its toll on phishing, so attackers find ways around it, including SpyEye

Real-time phishing attacks that cheat two-factor authentication are on the rise around the globe as phishers adapt to the latest barriers put in their way, according to a team of researchers.

Researchers at Trusteer today said 30 percent of all attacks during the past two-and-a-half months against websites using two-factor authentication have been real-time, man-in-the-middle (MITM) methods that allow the attackers to bypass this stronger authentication. The data comes from a sampling of thousands of phishing attacks monitored by the researchers.

Phishing attacks typically are static, so they are mostly rendered powerless when a bank uses two-factor authentication, such as one-time passwords. That's because the attacker may be able to capture the first level of credentials, but they aren't able to easily capture and use OTPs, which quickly expire.

So phishers are adapting their attacks to find ways around stronger authentication, and security experts say it was only a matter of time until they routinely started cheating banks and other transactional sites' two-factor authentication. This type of real-time MITM attack has been isolated and rare thus far, experts say.

"This sort of thing is going to be on the rise because more banks are implementing two-factor and out-of–band authentication, so the phishers have no choice but to do this," says Nitesh Dhanjani, a senior manager at Ernst & Young and security expert.

Trusteer researchers have spotted these attacks in South Africa, Europe, and now in the U.S., says Mickey Boodaei, CEO of Trusteer. And while these attacks are not a new concept, this is the first time his team has seen them in such high numbers, he says. "We have seen them before in very small quantities," he says.

Meanwhile, researchers at M86 Security are seeing another trend in attacks on online bank transactions. Bradley Anstis, vice president of technology strategy with M86, says his team is seeing more activity from the SpyEye Trojan as Zeus gradually declines. "We're not seeing the phishing angle, but we are seeing U.S. banks being targeted with SpyEye," he says. They see more man-in-the-browser attacks taking over user sessions than starting off from a phishing site, he says.

Overall, phishing has been on the decline, especially with two-factor authentication now more commonly in the picture, he says. "We've certainly seen a pretty big drop-off in phishing sites in the last year or two. Two-factor has really cooled off phishing," Anstis says. "Now attackers are moving into taking over a user's actual session. They will wait until they log in rather than capture their usernames, etc."

Trusteer's Boodaei says in these latest real-time phishing attacks, the victims are initially lured to the site with a phishing email posing as their bank, with a phony link to the real-time phishing site. "So as the user tries to log on, the phishing site immediately pushes [their credentials] to the real website, so at the end of the process the fraudsters have an authenticated session with the bank," he says. "This is all taking place in real time."

When the victim gets his OTP via his cell phone, for example, he then types it into the phishing site, assuming all the while that he is on his bank's site. The attackers then use that number before it expires to finalize the authentication process and start their own session with the user's stolen credentials.

He says unlike some phishing gangs that are split into groups who steal credentials and those who buy them to commit the fraud, this attack is waged by a group that both steals the information and commits the fraud.

The underlying problem, meanwhile, is that two-factor authentication can be bypassed, according to security experts. "There are a lot of heads stuck in the sand assuming they are protected," M86's Anstis says.

Aside from locking down the browser, other defensive options include transaction-verification tools. "Two-factor authentication basically has nowhere to go ... to avoid fraudsters from logging onto victims' accounts," Trusteer's Boodaei says. "What banks and other organizations are doing are using various types of verification technology when they [the criminals] actually try to move money out of the account. That won't prevent criminals from logging into your account, but it may prevent them from moving money out."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio