Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/9/2010
03:05 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Researchers See Real-Time Phishing Jump

Two-factor authentication takes its toll on phishing, so attackers find ways around it, including SpyEye

Real-time phishing attacks that cheat two-factor authentication are on the rise around the globe as phishers adapt to the latest barriers put in their way, according to a team of researchers.

Researchers at Trusteer today said 30 percent of all attacks during the past two-and-a-half months against websites using two-factor authentication have been real-time, man-in-the-middle (MITM) methods that allow the attackers to bypass this stronger authentication. The data comes from a sampling of thousands of phishing attacks monitored by the researchers.

Phishing attacks typically are static, so they are mostly rendered powerless when a bank uses two-factor authentication, such as one-time passwords. That's because the attacker may be able to capture the first level of credentials, but they aren't able to easily capture and use OTPs, which quickly expire.

So phishers are adapting their attacks to find ways around stronger authentication, and security experts say it was only a matter of time until they routinely started cheating banks and other transactional sites' two-factor authentication. This type of real-time MITM attack has been isolated and rare thus far, experts say.

"This sort of thing is going to be on the rise because more banks are implementing two-factor and out-of–band authentication, so the phishers have no choice but to do this," says Nitesh Dhanjani, a senior manager at Ernst & Young and security expert.

Trusteer researchers have spotted these attacks in South Africa, Europe, and now in the U.S., says Mickey Boodaei, CEO of Trusteer. And while these attacks are not a new concept, this is the first time his team has seen them in such high numbers, he says. "We have seen them before in very small quantities," he says.

Meanwhile, researchers at M86 Security are seeing another trend in attacks on online bank transactions. Bradley Anstis, vice president of technology strategy with M86, says his team is seeing more activity from the SpyEye Trojan as Zeus gradually declines. "We're not seeing the phishing angle, but we are seeing U.S. banks being targeted with SpyEye," he says. They see more man-in-the-browser attacks taking over user sessions than starting off from a phishing site, he says.

Overall, phishing has been on the decline, especially with two-factor authentication now more commonly in the picture, he says. "We've certainly seen a pretty big drop-off in phishing sites in the last year or two. Two-factor has really cooled off phishing," Anstis says. "Now attackers are moving into taking over a user's actual session. They will wait until they log in rather than capture their usernames, etc."

Trusteer's Boodaei says in these latest real-time phishing attacks, the victims are initially lured to the site with a phishing email posing as their bank, with a phony link to the real-time phishing site. "So as the user tries to log on, the phishing site immediately pushes [their credentials] to the real website, so at the end of the process the fraudsters have an authenticated session with the bank," he says. "This is all taking place in real time."

When the victim gets his OTP via his cell phone, for example, he then types it into the phishing site, assuming all the while that he is on his bank's site. The attackers then use that number before it expires to finalize the authentication process and start their own session with the user's stolen credentials.

He says unlike some phishing gangs that are split into groups who steal credentials and those who buy them to commit the fraud, this attack is waged by a group that both steals the information and commits the fraud.

The underlying problem, meanwhile, is that two-factor authentication can be bypassed, according to security experts. "There are a lot of heads stuck in the sand assuming they are protected," M86's Anstis says.

Aside from locking down the browser, other defensive options include transaction-verification tools. "Two-factor authentication basically has nowhere to go ... to avoid fraudsters from logging onto victims' accounts," Trusteer's Boodaei says. "What banks and other organizations are doing are using various types of verification technology when they [the criminals] actually try to move money out of the account. That won't prevent criminals from logging into your account, but it may prevent them from moving money out."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27706
PUBLISHED: 2021-04-14
Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"IPMacBindIndex "request. This occurs because the "formIPMacBindDel" function directly passes the parameter "IPMacBind...
CVE-2021-27707
PUBLISHED: 2021-04-14
Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"portMappingIndex "request. This occurs because the "formDelPortMapping" function directly passes the parameter "portMappingIn...
CVE-2021-28098
PUBLISHED: 2021-04-14
An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector runs with administrative privileges and writes logs entries to a file in %PROGRAMDATA%\ForeScout SecureConnector\ that has full permissions for...
CVE-2021-30493
PUBLISHED: 2021-04-14
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the ChromaBroadcast subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other wor...
CVE-2021-30494
PUBLISHED: 2021-04-14
Multiple system services installed alongside the Razer Synapse 3 software suite perform privileged operations on entries within the Razer Chroma SDK subkey. These privileged operations consist of file name concatenation of a runtime log file that is used to store runtime log information. In other wo...