3 ms·
Have you ever seen a phishing attack that actually asks for and uses the two factor auth code? I don't deny that this is possible, I've just never seen it.
by ryan-c 11y ago
Have you ever seen a phishing attack that actually asks for and uses the two factor auth code? I don't deny that this is possible, I've just never seen it.
- eli 11y agoNot only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html https://www.schneier.com/blog/archives/2009/09/hacking_two-f...
- adrianmacneil 11y agoI haven't been targeted by one myself, but I've definitely heard of it happening. When the stakes are this high (million dollar+ payouts), attackers spend months infiltrating organizations, and adding 2fa to what is already a custom spear phishing page is not that much of a hurdle.