Hackers are getting better at defeating 2FA security

Image for an article called Hackers Get Better and Better in Defeating Your 2FA Security

Photography: DANIEL MIHAILESCU / AFP (Getty Images)

Two-factor authentication, or 2FA, is sold to web users as one of the most important and reliable tools to secure your digital life. You probably know how does it work: By giving your account not only your password, but also secondary information (usually automated code sent to your phone or device of your choice), companies can confirm that whoever signs into your account is definitely you, not just some jerk who managed to get there. to your personal information.

However, according to new research, the aforementioned bullies have unfortunately found a number of effective ways to circumvent your 2FA protection – and are increasingly using these methods.

The study, published by academic researchers from Stony Brook University and cybersecurity firm Palo Alto Networks, shows the recent discovery of a set of identity theft tools used to get through authentication protection. Tool kits are malicious software programs designed to help with cyber attacks. They were designed by criminals and are usually sold and distributed on dark web forums, where any digital malware can buy and use them. The Stony Brook study, originally reported by The Record, shows that these malicious programs are used to phish and steal 2FA login data from users of large websites. They’re also exploding in use — with researchers finding a total of at least 1,200 different tools floating in the digital underworld.

Admittedly, cyber attacks that can defeat 2FA are not new, but the distribution of these malware shows that they are becoming more sophisticated and increasingly used.

Toolkits win 2FA by stealing something that is probably more valuable than your password: your 2FA authentication cookies, which are files stored on your web browser when the authentication process takes place.

According to the study, these cookies can be stolen in one of two ways: a hacker can infect the victim’s computer with data theft malware or he can steal cookies in passing— Together with your password — before they ever get to a page trying to authenticate you. This is done by phishing the victim and capturing her web traffic via a The man in the middle a stylistic attack that redirects the traffic to the phishing site and related reverse proxy server. This way, the attacker can enter between you and the website you are trying to log in to – thus capturing all the information that passes between the two of you.

Once a hacker quietly hijacks your traffic and grabs those cookies, he can enjoy access to your account as long as the cookie lasts. In some cases – such as social media accounts – this can take a long time, The minutes state.

It’s all a bit awkward, because in recent years it’s been 2FA broadly speaking as an effective method of identity verification and account security. And yet, recent studies have also shown that many people don’t even bother with the adoption of 2FA in the first place, which, if true, means that we probably have bigger fish to fry in the security department on the web.

Source link

Naveen Kumar

Friendly communicator. Music maven. Explorer. Pop culture trailblazer. Social media practitioner.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

Back to top button