5 ms·
Were the spear fishing attacked also used to get 2FA, or did these accounts not have 2FA? Would hardware based 2FA not have stopped this?
by ehsankia 6y ago
Were the spear fishing attacked also used to get 2FA, or did these accounts not have 2FA? Would hardware based 2FA not have stopped this?
- deleted 6y ago[deleted]
- zamalek 6y agoI haven't seen a form of phishing that hardware 2FA doesn't stop. Yes, it would have.
- fareesh 6y agoThe way it is worded can also mean that there were XSS vulnerabilities in the internal tool since they are saying "gained information about how our processes work". I feel like that's a strange and vague thing to say. The right kind of xss vulnerability would enable them to bypass 2fa too, maybe steal backup codes even.
- berkes 6y agoI understood that line as 'saw names, contact detail, positions and permissions of employees'
- Thorrez 6y agoIf there's an XSS attack I don't consider that phishing.
- fareesh 6y agoIsn't it both? Phish first user, post to internal tool and xss attack second user.
- Thorrez 6y agoYeah I guess you're right, it could be like an exploit chain where 1 link in the chain is phishing to gain access to something and xss is the next link for lateral movement. But I don't know what "The right kind of xss vulnerability would enable them to bypass 2fa too" means. If the attacker doesn't have 2FA I would think the attacker can't log in, thus meaning the first link of the chain has no purpose. But I also think XSS in this case is not very likely. From interviews with the attackers it sounds like they're social engineering experts who hang out on social engineering forums, not XSS experts[1][2][3]. [1] https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/ https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-e... [2] https://www.nytimes.com/2020/07/17/technology/twitter-hackers-interview.html https://www.nytimes.com/2020/07/17/technology/twitter-hacker... [3] https://krebsonsecurity.com/2020/07/twitter-hacking-for-profit-and-the-lols/ https://krebsonsecurity.com/2020/07/twitter-hacking-for-prof...
- monoideism 6y agoSignificant forms of phishing are stopped by U2F (as used by Yubikey and others), by crytographically binding your credential to the domain name , and only issuing an approval signature if the site matches. Obviously, this stops credential phishing. https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... https://medium.com/@antonisikora/how-u2f-security-keys-can-eliminate-phishing-e368e33024be https://medium.com/@antonisikora/how-u2f-security-keys-can-e...
- Thorrez 6y agoYou and zamalek appear to be in agreement.
- monoideism 6y agoYou're right - I misread the comment. I'd delete my comment if I could.
- Thorrez 6y agoIt does depend on whether the hardware 2FA is U2F (which stops phishing) or OTP[1] (which doesn't). [1] http://www.tokenguard.com/RSA-SecurID-SID700.asp http://www.tokenguard.com/RSA-SecurID-SID700.asp
- technion 6y agoWithout details it's hard to say. They talk about "phone spear phishing". It's within the realm of that description to say they were hit the same way someone I know recently was - someone called and said "Can you just install Teamviewer on your desktop for me and give access to a logged on session".
- lighthazard 6y agoMaybe? I imagine a spear fishing attack could entail the target is sent to a false panel to login where it sends a true 2FA request. The target then freely gives this 2FA code to the attacker.
- Thorrez 6y agoThat compromise OTP 2FA, but not U2F 2FA.
- bananabreakfast 6y agoIt says right there in the linked page that the phishing attack was able to manipulate multiple employees into giving access past their 2FA.
- Thorrez 6y agoYeah, that answers 1 of the questions. But we still don't know what type of 2FA was being used, or what technique the attackers used.