The summer the codes were stolen
Sep 13th, 2022 by Jesper Kråkhede
While most of us were on vacation this summer, a phishing campaign went through more than 130 organisations. The researchers who mapped it found close to ten thousand stolen accounts.
The method was simple. Employees got a text message, supposedly from their IT department, saying their account needed attention. The link went to a convincing copy of the company´s login page. The victims entered their username, password and the one-time code from their second factor, and the attackers used them immediately, in real time, before the code expired.
Several of the victims were technology companies with good security teams. It didn´t matter. A second factor that can be typed in can also be typed into the wrong page.
One company stood out. Its employees received the same messages and some of them did enter their credentials and codes. But the attack failed, because the company used hardware security keys. A key like that only works with the real site, no matter how convincing the fake is.
The technical lessons. Move privileged users, and then everyone else, to authentication that can´t be phished: hardware keys, Windows Hello for Business or certificate based. Require a managed device for sensitive access, so stolen credentials don´t work elsewhere. And make sure you can detect a session being used from a strange place.
The second factor is good. A second factor that can´t be phished is better.