7 ms·

London Calling: Two-Factor Authentication Phishing from Iran

55 points by secfirstmd 11y ago

rlpb 11y ago
The article says, in "One Quick Check to Spot the Fakes!", to look for https instead of http. But this is no good: an attacker could use a domain-validated SSL certificate for the fake domains used.
- fredley 11y ago
  This. The only way to check is to verify the certificate, which on Chrome means clicking the padlock, switching to the Connection tab, and then viewing certificate information. Not exactly straight forward.
  - Flimm 11y ago
    If you already trust your CA authorities and you already know what domain to expect, then that's not necessary, you only need to check for HTTPS and the domain name.
    - rlpb 11y ago
      Checking the domain name isn't sufficient because some letters look similar to each other and not all users are capable of doing precise string comparison matching in the same way that programmers do. The article has an example - qoogle.com instead of google.com. I bet that a significant number of users would miss this when asked to check.
      - leni536 11y ago
        How does it differ from checking the domain name in the certificate? I don't get it.
        rlpb 11y ago
        It doesn't differ from checking the domain name in the certificate. It does differ from checking the entity in the EV certificate, which is generally the legal name of the company. In theory, a phisher could register a company with a similar name to the target website's legal name, obtain a valid EV certificate for that, and then phish using a similar looking domain with a similar looking EV certificate legal name. In practice, if that were to begin happening, I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations, and then phishers would not have an easy path to exploit this route.
        leni536 11y ago
        The discussion started with only mentioning DV certificates. > I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations Wait, they don't require that now?
  - danieldk 11y ago
    The only way to check is to verify the certificate, Or use a U2F key as a second factor. Avoiding MITM fishing attacks is one its explicit design goals. In short: the MITM does not have the right key handle, so it cannot initiate the challenge-response. https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview.... https://developers.yubico.com/U2F/Protocol_details/Key_generation.html https://developers.yubico.com/U2F/Protocol_details/Key_gener... https://developers.yubico.com/U2F/Protocol_details/fido-u2f-overview-v1.0.pdf https://developers.yubico.com/U2F/Protocol_details/fido-u2f-... U2F is supported by Google and Dropbox (since one or two weeks). Keys cost ~10-15 Euro a pop. Buy two keys, keep one with you, put the other in a fire-proof safe.
Flimm 11y ago
The only real protection from this is to verify that the SSL icon is displayed in the address bar, and that the domain is the domain you expected. It's a shame more websites don't educate users to do this. This gives me an idea for a Javascript widget that guides users to verify the address bar, with an appropriate demonstration screenshot based on the expected domain, and the user's browser.
- rlpb 11y ago
  Worse, websites will redirect you to a different domain as part of their normal process. For example, in the UK, the Lloyds Bank main website is lloydsbank.com, but click (on their insecure page) for online banking logon and you're taken to https://online.lloydsbank.co.uk https://online.lloydsbank.co.uk. The main website for another UK bank, NatWest, is on natwest.com (it redirects to http://personal.natwest.com http://personal.natwest.com), but click for online banking and you're taken to a page on https://www.nwolb.com https://www.nwolb.com Telling users to check the domain is useless, since legitimate sites condition users to ignore it. EV certificates do fix this to some extent, but users are not conditioned to check these, and it domain-validated certificates just complicate matters for them. I would prefer to see legislation that mandates security standards for entities that handle personal data. In the UK, secondary legislation against an amended Data Protection Act that mandates EV certificates would work well for this, IMHO. This won't help the Internet at large, but would at least help condition UK users to know what to check.
  - deanclatworthy 11y ago
    I'd love to see EV certificates everywhere, and cheap enough that made them practical for small business owners who collect minimal personal information. Should you really need an EV certificate to have a newsletter sign up form? Probably not, but I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year [0] for the privilege. But absolutely, anyone storing serious personal information (credit cards, banking information, social security numbers) should be required by law to have an EV cert. [0] https://www.geotrust.com/uk/ssl/ https://www.geotrust.com/uk/ssl/
nickik 11y ago
Google already has a solution for this, why are they ignoring it? Google allready supports 2FA with the new U2F protocol. With this protocol the app id (uri) is part of the process and its provided by the browser. Thus phishing attacks will fail. Sadly Firefox and other broswers do not yet support this, only Chrome. I really hope this replaces the old 2FA TOTP style and specially SMS. For people who want to use both, there is a nice solution. You can use YubiKey as your U2F token and for websites that don't support this you can use the YubiKey as your 2FA with the help of a android app called 'Yubico Authenticater' and NFC. I prefer it to Google Authenticator because I can move between android devices (just came in useful when my phone broke). Google does not yet support NFC U2F on their mobile browsers as far as I know. Thats very sad, I really want to be able to disable HOTP solution. See the protocol here: https://image.slidesharecdn.com/fidou2fin10minutescis2015-150622164512-lva1-app6891/95/fido-u2-f-in-10-minutes-cis-2015-17-638.jpg?cb=1434991550 https://image.slidesharecdn.com/fidou2fin10minutescis2015-15...
nickik 11y ago
Is their some kind of addon that warns people about url that look the simular? That might be easy and useful. Edit: With certificate pinning you could put out a msg to the User to verfiy if he understands that this is the first time he visits the site. The problem is when to put out such a warning, i dont want to do that every time I go on a new site.

55 points by secfirstmd 11y ago

rlpb 11y ago

The article says, in "One Quick Check to Spot the Fakes!", to look for https instead of http. But this is no good: an attacker could use a domain-validated SSL certificate for the fake domains used.

fredley 11y ago
This. The only way to check is to verify the certificate, which on Chrome means clicking the padlock, switching to the Connection tab, and then viewing certificate information. Not exactly straight forward.
- Flimm 11y ago
  If you already trust your CA authorities and you already know what domain to expect, then that's not necessary, you only need to check for HTTPS and the domain name.
  - rlpb 11y ago
    Checking the domain name isn't sufficient because some letters look similar to each other and not all users are capable of doing precise string comparison matching in the same way that programmers do. The article has an example - qoogle.com instead of google.com. I bet that a significant number of users would miss this when asked to check.
    - leni536 11y ago
      How does it differ from checking the domain name in the certificate? I don't get it.
      - rlpb 11y ago
        It doesn't differ from checking the domain name in the certificate. It does differ from checking the entity in the EV certificate, which is generally the legal name of the company. In theory, a phisher could register a company with a similar name to the target website's legal name, obtain a valid EV certificate for that, and then phish using a similar looking domain with a similar looking EV certificate legal name. In practice, if that were to begin happening, I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations, and then phishers would not have an easy path to exploit this route.
        leni536 11y ago
        The discussion started with only mentioning DV certificates. > I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations Wait, they don't require that now?
- danieldk 11y ago
  The only way to check is to verify the certificate, Or use a U2F key as a second factor. Avoiding MITM fishing attacks is one its explicit design goals. In short: the MITM does not have the right key handle, so it cannot initiate the challenge-response. https://developers.yubico.com/U2F/Protocol_details/Overview.html https://developers.yubico.com/U2F/Protocol_details/Overview.... https://developers.yubico.com/U2F/Protocol_details/Key_generation.html https://developers.yubico.com/U2F/Protocol_details/Key_gener... https://developers.yubico.com/U2F/Protocol_details/fido-u2f-overview-v1.0.pdf https://developers.yubico.com/U2F/Protocol_details/fido-u2f-... U2F is supported by Google and Dropbox (since one or two weeks). Keys cost ~10-15 Euro a pop. Buy two keys, keep one with you, put the other in a fire-proof safe.

Flimm 11y ago

The only real protection from this is to verify that the SSL icon is displayed in the address bar, and that the domain is the domain you expected. It's a shame more websites don't educate users to do this. This gives me an idea for a Javascript widget that guides users to verify the address bar, with an appropriate demonstration screenshot based on the expected domain, and the user's browser.

rlpb 11y ago
Worse, websites will redirect you to a different domain as part of their normal process. For example, in the UK, the Lloyds Bank main website is lloydsbank.com, but click (on their insecure page) for online banking logon and you're taken to https://online.lloydsbank.co.uk https://online.lloydsbank.co.uk. The main website for another UK bank, NatWest, is on natwest.com (it redirects to http://personal.natwest.com http://personal.natwest.com), but click for online banking and you're taken to a page on https://www.nwolb.com https://www.nwolb.com Telling users to check the domain is useless, since legitimate sites condition users to ignore it. EV certificates do fix this to some extent, but users are not conditioned to check these, and it domain-validated certificates just complicate matters for them. I would prefer to see legislation that mandates security standards for entities that handle personal data. In the UK, secondary legislation against an amended Data Protection Act that mandates EV certificates would work well for this, IMHO. This won't help the Internet at large, but would at least help condition UK users to know what to check.
- deanclatworthy 11y ago
  I'd love to see EV certificates everywhere, and cheap enough that made them practical for small business owners who collect minimal personal information. Should you really need an EV certificate to have a newsletter sign up form? Probably not, but I wouldn't mind if it weren't for the fact that I'd pay over 200 pounds a year [0] for the privilege. But absolutely, anyone storing serious personal information (credit cards, banking information, social security numbers) should be required by law to have an EV cert. [0] https://www.geotrust.com/uk/ssl/ https://www.geotrust.com/uk/ssl/

nickik 11y ago

Google already has a solution for this, why are they ignoring it? Google allready supports 2FA with the new U2F protocol. With this protocol the app id (uri) is part of the process and its provided by the browser. Thus phishing attacks will fail. Sadly Firefox and other broswers do not yet support this, only Chrome. I really hope this replaces the old 2FA TOTP style and specially SMS. For people who want to use both, there is a nice solution. You can use YubiKey as your U2F token and for websites that don't support this you can use the YubiKey as your 2FA with the help of a android app called 'Yubico Authenticater' and NFC. I prefer it to Google Authenticator because I can move between android devices (just came in useful when my phone broke). Google does not yet support NFC U2F on their mobile browsers as far as I know. Thats very sad, I really want to be able to disable HOTP solution. See the protocol here: https://image.slidesharecdn.com/fidou2fin10minutescis2015-150622164512-lva1-app6891/95/fido-u2-f-in-10-minutes-cis-2015-17-638.jpg?cb=1434991550 https://image.slidesharecdn.com/fidou2fin10minutescis2015-15...

nickik 11y ago

Is their some kind of addon that warns people about url that look the simular? That might be easy and useful. Edit: With certificate pinning you could put out a msg to the User to verfiy if he understands that this is the first time he visits the site. The problem is when to put out such a warning, i dont want to do that every time I go on a new site.