Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/9/2010
03:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researchers See Real-Time Phishing Jump

Two-factor authentication takes its toll on phishing, so attackers find ways around it, including SpyEye

Real-time phishing attacks that cheat two-factor authentication are on the rise around the globe as phishers adapt to the latest barriers put in their way, according to a team of researchers.

Researchers at Trusteer today said 30 percent of all attacks during the past two-and-a-half months against websites using two-factor authentication have been real-time, man-in-the-middle (MITM) methods that allow the attackers to bypass this stronger authentication. The data comes from a sampling of thousands of phishing attacks monitored by the researchers.

Phishing attacks typically are static, so they are mostly rendered powerless when a bank uses two-factor authentication, such as one-time passwords. That's because the attacker may be able to capture the first level of credentials, but they aren't able to easily capture and use OTPs, which quickly expire.

So phishers are adapting their attacks to find ways around stronger authentication, and security experts say it was only a matter of time until they routinely started cheating banks and other transactional sites' two-factor authentication. This type of real-time MITM attack has been isolated and rare thus far, experts say.

"This sort of thing is going to be on the rise because more banks are implementing two-factor and out-of–band authentication, so the phishers have no choice but to do this," says Nitesh Dhanjani, a senior manager at Ernst & Young and security expert.

Trusteer researchers have spotted these attacks in South Africa, Europe, and now in the U.S., says Mickey Boodaei, CEO of Trusteer. And while these attacks are not a new concept, this is the first time his team has seen them in such high numbers, he says. "We have seen them before in very small quantities," he says.

Meanwhile, researchers at M86 Security are seeing another trend in attacks on online bank transactions. Bradley Anstis, vice president of technology strategy with M86, says his team is seeing more activity from the SpyEye Trojan as Zeus gradually declines. "We're not seeing the phishing angle, but we are seeing U.S. banks being targeted with SpyEye," he says. They see more man-in-the-browser attacks taking over user sessions than starting off from a phishing site, he says.

Overall, phishing has been on the decline, especially with two-factor authentication now more commonly in the picture, he says. "We've certainly seen a pretty big drop-off in phishing sites in the last year or two. Two-factor has really cooled off phishing," Anstis says. "Now attackers are moving into taking over a user's actual session. They will wait until they log in rather than capture their usernames, etc."

Trusteer's Boodaei says in these latest real-time phishing attacks, the victims are initially lured to the site with a phishing email posing as their bank, with a phony link to the real-time phishing site. "So as the user tries to log on, the phishing site immediately pushes [their credentials] to the real website, so at the end of the process the fraudsters have an authenticated session with the bank," he says. "This is all taking place in real time."

When the victim gets his OTP via his cell phone, for example, he then types it into the phishing site, assuming all the while that he is on his bank's site. The attackers then use that number before it expires to finalize the authentication process and start their own session with the user's stolen credentials.

He says unlike some phishing gangs that are split into groups who steal credentials and those who buy them to commit the fraud, this attack is waged by a group that both steals the information and commits the fraud.

The underlying problem, meanwhile, is that two-factor authentication can be bypassed, according to security experts. "There are a lot of heads stuck in the sand assuming they are protected," M86's Anstis says.

Aside from locking down the browser, other defensive options include transaction-verification tools. "Two-factor authentication basically has nowhere to go ... to avoid fraudsters from logging onto victims' accounts," Trusteer's Boodaei says. "What banks and other organizations are doing are using various types of verification technology when they [the criminals] actually try to move money out of the account. That won't prevent criminals from logging into your account, but it may prevent them from moving money out."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.