PDA

View Full Version : Phishers go after two-factor authentication systems


Kougar
07-12-2006, 03:01 AM
So much for this stuff being secure! I guess it really just shows that once you factor people into the equation, nothing is really secure... :roll:

Two-factor authentication has been touted as a solution to the problem of users giving up their passwords too easily. One group of phishers is determined to prove otherwise, as a recent attack demonstrates.

On the surface, two-factor authentication is a relatively simple solution. In order to log in to a protected site, users must enter a password as well as a second bit of information. In the case of Citibank and a handful of other financial institutions, users are given a USB dongle which displays a passphrase or string of numbers that updates every 60 seconds. It is only when the correct password is paired with a valid passphrase generated by the token that the user is granted access to their account information.

A group of phishers operating out of a Russian website attempted to trick Citibank customers in the customary manner, by directing them to a lookalike website and asking for the usual personal information. As an added bonus, the phishers also asked for the passphrase generated by the token. Once they had both pieces of the authentication information, they would presumably then transmit it onto Citibank within a 60-second time period and go about their nefarious business. It's a simple adaptation of existing methods: just add an additional field to existing forms and they are all set.

Quoted article taken from http://arstechnica.com/news.ars/post/20060711-7237.html (http://arstechnica.com/news.ars/post/20060711-7237.html)

GIBSON
07-12-2006, 12:15 PM
As long as you don't respond to obvious phising mails you should be fine IMHO. I don't think there is any other way they try to get you to their site?

Kougar
07-12-2006, 07:45 PM
As long as you don't respond to obvious phising mails you should be fine IMHO. I don't think there is any other way they try to get you to their site?

Well, using common(And not so common) mispellings to credit card company's sites is another way, and works pretty well when the user is in a hurry or badly distracted...

Judging by the article though, the premise is someone just has to get themselves in as the middle-man. Doesn't matter how, but as long as they do then not even the much touted "safe" authentication system Citi/Amex and other company's advertise they they have is not really any safer, really...