Hackers Use Phishing Emails to Harvest Two-Factor Gmail Codes
Conventional wisdom says that adding two-factor authentication (2FA) will keep your accounts safe from most phishing scams, but a new wave of sophisticated automated attacks is reminding us that 2FA isn’t infallible. As with all security measures, it’s only as secure as the weakest link — the human one. The new phishing campaign tricks people into handing over their account details and their 2FA tokens.
The report comes from Amnesty International, which doesn’t usually publicize cybersecurity news. In this case, Amnesty has a stake in things because the attacks have mainly targeted activists and journalists in the Middle East and North Africa. As Amnesty explains, there are several distinct phishing campaigns ongoing that are likely linked.
In the most sophisticated campaign, the attackers have targeted hundreds of Yahoo and Google accounts used by activists. The goal is to bypass two-factor protections and gain access to the account. Examining the suspicious emails flagged by activists in 2017 and 2018, Amnesty found links that claim to be security alerts. However, they redirect to a fake page that harvests account details. That’s not unique, but the next phase steps it up.
After the target entered a username and password, the malicious sites would remotely log into the account. It then requested a code via SMS if the account had two-factor enabled. The fake site asked for the code, which wouldn’t seem out of the ordinary — you’d have to put a 2FA code in during a normal login. However, the malicious site used that code to log into the account remotely before the token expired. The user would be prompted to change their password, which the attacker would then save for later use.
The second and third campaigns used similar tactics but focused on users of the encrypted email services Protonmail and Tutanota. In both cases, the attackers registered seemingly authentic domains with fake login pages. These domains have since been shut down.
Amnesty International believes Gulf states are behind the phishing campaigns, hoping to gather information on dissidents and protesters in their countries. Let this be a reminder that two-factor authentication is not a silver bullet. You still need to be wary of emails with links to external pages. You should only input your account credentials on sites that you have confirmed are the real deal.
Continue reading
Someone Hacked Ray Tracing Into the SNES
Surely, a game console from the 90s couldn't support ray tracing, right? Wrong. Game developer and engineer Ben Carter hacked ray tracing into the Super NES with a little help from an FPGA dev board.
New ‘Morpheus’ CPU Design Defeats Hundreds of Hackers in DARPA Tests
A new CPU design has won accolades for defeating the hacking efforts of nearly 600 experts during a DARPA challenge. Its approach could help us close side-channel vulnerabilities in the future.
Nintendo Switch Hacked to Run Linux, So Can We Get Save Game Backups Now?
The Nintendo Switch has been hacked and is capable of booting Linux in a new cold-boot exploit. Will Nintendo finally relent on user saved games — or lock things down that much tighter?
New Malware Spreads Through Hacked Sites as Fake Browser Update
There's a new piece of malware making the rounds online via hacked websites that uses sophisticated redirects and modified JavaScript to load a malicious payload on your computer.