Hacker Kevin Mitnick shows how to bypass 2FA – TechCrunch

A new exploit allows hackers to spoof two-factor authentication requests by sending a user to a fake login page and then stealing the username, password, and session cookie.

KnowBe4 Chief Hacking Officer Kevin Mitnick showed the hack in a public video. By convincing a victim to visit a typo-squatting domain liked “LunkedIn.com” and capturing the login, password, and authentication code, the hacker can pass the credentials to the actual site and capture the session cookie. Once this is done the hacker can login indefinitely. This essentially uses the one time 2FA code as a way to spoof a login and grab data.

“A white hat hacker friend of Kevin’s developed a tool to bypass two-factor authentication using social engineering tactics – and it can be weaponized for any site,” said Stu Sjouwerman, KnowBe4 CEO. “Two-factor authentication is intended to be an extra layer of security, but in this instance, we clearly see that you can’t rely on it alone to protect your organization.”

Sjouwerman notes that anti-phishing education is deeply important and that a hack like this is impossible to complete if the victim is savvy about security and the dangers of clicking links that come into your email box. To demonstrate this, Sjouwerman sent me an email seemingly addressed to me from Matt Burns (matt@techcrunch.com) talking about a typo in a post. When I clicked on it I was transferred to a SendGrid redirect site and dumped into TechCrunch – but the payload could have been more nefarious.

Cool read from TC Source Link

Comments

Post a Comment

Popular posts from this blog

Google’s new Tour Creator lets students make their own VR tours – TechCrunch

Image
Google today launched a new tool for teachers and their students called Tour Creator, which allows anyone to create their own VR tour using imagery from Google’s Street View or their own 360-degree photos. The new app is designed to work with Google Cardboard and Google’s existing VR “field trips” app Expeditions . The goal with Expeditions is to let people virtually travel the world to see far off places they may never have the chance to visit in person – like Antarctica or Machu Picchu, for example. Google says that since Expeditions’ arrival in 2015, over three million students have virtually visited places around the globe. Now, the idea is to let students and teachers themselves build their own VR experiences and stories without needing technical knowledge. Instead, using Tour Creator, anyone can build an immersive 360-degree tour from their computer. To use the service, you click to get started, give the tour a name and upload a cover photo. You can then search through Go
Read more

New malware highjacks your Windows clipboard to change crypto addresses – TechCrunch

Image
In what amounts to be an amazingly nefarious bit of malware, hackers have created an exploit that watches 2.3 million high-value crypto wallets and replaces the addresses in the Windows clipboard with an address associated with the hackers. In other words, you could paste your own wallet address – 3BYpmdzASG7S6WrpmrnzJCX3y8kduF6Kmc, for example – and the malware would subtly (or unsubtly) change it to its own private wallet. Because it happens in the clipboard most people wouldn’t notice the change between copying and pasting. Security researchers at BleepingComputer have found similar hijackers in the wild but this latest version is actively watching valuable wallets and trying grab bitcoin as they enter the accounts. Below is an example of the malware at work. The malware runs a massive, 83MB DLL file that masquerades as a Direct X service. Inside the DLL is a 2.5 million line text file full of bitcoin addresses. In the above test when cutting and pasting from an HTML page into W
Read more

Bitcoin passes $7K bringing all 100 top coins up with it – TechCrunch

Image
Bitcoin is moving up, and it’s taking 99 of its best friends along for the ride. In the last 24 hours, every one of the top 100 coins by market cap was in the green with 84 of them posting gains of over 5 percent. At the time of writing, Bitcoin was sitting at $7,310, up 14 percent in the last 7 days and up almost 10 percent in the last 24 hours. CoinMarketCap Top 100 Bitcoin itself crossed the $7,000 mark for the first time in the last month, an indication but no sure sign that it might be shaking off a summer slump that’s seen prices plunge below $6,000 on more than one occasion. Bitcoin is quickly moving back toward early June norms around $7,500 though may meet resistance at $7,750 . In March, Bitcoin dipped below the $10,000 mark and it’s been unable to mount a rally back above that level in the months since. screenshot via CoinMarketCap They may not last, but mid-July’s gains aren’t just a Bitcoin story. Out of the top 100 coins, 24 coins made double digit gains in the l
Read more