2 ms·

Cloud Attacks Are Bypassing MFA, Feds Warn

• 1vuio0pswjnm7 6y ago
  "Meanwhile, attackers have been able to bypass MFA using a "pass-the-cookie" attack. Browser cookies are used to store user authentication information so a website can keep a user signed in. The authentication information is stored in a cookie after the MFA test is satisfied, so the user isn't prompted for an MFA check again. Thus, if attackers extract the right browser cookies they can authenticate as a targeted user in a separate browser session, bypassing all MFA checkpoints." I have been testing this idea for a while, e.g., with Gmail, using a saved session cookie for an account I registered. Not as an "attack" but as a possible way to check for new mail from outside the browser, without using a browser, on the command line. It has been working for an extended period of time. Are sessions really supposed to last weeks, months, years. It seems like a simple solution would be to log users out of a session after a period of inactivity and invalidate the so-called session cookie. I have seen bank websites do this but I don't see them begging users to use MFA the way Google does. Really makes me wonder what is the real goal of MFA, collect more data from users, or "security". If it is the later, it appears that MFA is easily bypassed, forever, by simply stealing a single session cookie. Instead of advising users to keep handing over more data to satisfy some MFA test, users could just as well be advised to save one cookie and use that one cookie everytime they want instant access, and to treat that cookie like a key to a lock. Anyone with it has access, the bearer of the cookie is pre-authenticated. Like it or not, even if users are follwing Google's MFA advice to the letter, they are still creating an additonal, evergreen "key" every time they log in and fail to log out.