Hacker beats two-factor authentication with phishing attack

Hacker Kevin Mitnick produced a video on YouTube showing how the exploit works by sending victims to a fake login page.
Click to expand...

This really isn't very impressive, or new. MITM attacks allow this sort of thing to happen.

Like, bravo, you've succeeded in spoofing a website and luring visitors into giving up their credentials. Well done. Here's a noddy badge.
 
Last edited:
Logical, I suppose. If a phishing site can "relay" your user/pass, it can also relay the 2FA request and response. Hopefully, they will come up with some way to thwart this soon, perhaps some way of encoding the real server's public SSL key and IP address into the 2FA so that it will only work when that is valid.
 
CataclysmZA said:
This really isn't very impressive, or new. MITM attacks allow this sort of thing to happen.

Like, bravo, you've succeeded in spoofing a website and luring visitors into giving up their credentials. Well done. Here's a noddy badge.
Click to expand...

No need to be cynical. The problem is that most people have been mislead into believing that if they have to use 2FA to login it's rock solid, and this is a more complicated variation on the normal phishing exploit as it requires a two way transfer of information when most phishing attacks simply relay the auth details one way. If nothing else, this is important awareness.
 
garp said:
Logical, I suppose. If a phishing site can "relay" your user/pass, it can also relay the 2FA request and response. Hopefully, they will come up with some way to thwart this soon, perhaps some way of encoding the real server's public SSL key and IP address into the 2FA so that it will only work when that is valid.
Click to expand...

Capitec works like this, if you want to pay an existing beneficiary you have to enter new OTP, to add and pay a new beneficiary, they would need to get your secondary authentication 3 times, login, adding and paying.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X