Researchers See Real-Time Phishing Jump

Real-time phishing attacks that cheat two-factor authentication are on the rise around the globe as phishers adapt to the latest barriers put in their way, according to a team of researchers.

Researchers at Trusteer today said 30 percent of all attacks during the past two-and-a-half months against websites using two-factor authentication have been real-time, man-in-the-middle (MITM) methods that allow the attackers to bypass this stronger authentication. The data comes from a sampling of thousands of phishing attacks monitored by the researchers.

Phishing attacks typically are static, so they are mostly rendered powerless when a bank uses two-factor authentication, such as one-time passwords. That's because the attacker may be able to capture the first level of credentials, but they aren't able to easily capture and use OTPs, which quickly expire.

So phishers are adapting their attacks to find ways around stronger authentication, and security experts say it was only a matter of time until they routinely started cheating banks and other transactional sites' two-factor authentication. This type of real-time MITM attack has been isolated and rare thus far, experts say.

"This sort of thing is going to be on the rise because more banks are implementing two-factor and out-of–band authentication, so the phishers have no choice but to do this," says Nitesh Dhanjani, a senior manager at Ernst & Young and security expert.

Trusteer researchers have spotted these attacks in South Africa, Europe, and now in the U.S., says Mickey Boodaei, CEO of Trusteer. And while these attacks are not a new concept, this is the first time his team has seen them in such high numbers, he says. "We have seen them before in very small quantities," he says.

Meanwhile, researchers at M86 Security are seeing another trend in attacks on online bank transactions. Bradley Anstis, vice president of technology strategy with M86, says his team is seeing more activity from the SpyEye Trojan as Zeus gradually declines. "We're not seeing the phishing angle, but we are seeing U.S. banks being targeted with SpyEye," he says. They see more man-in-the-browser attacks taking over user sessions than starting off from a phishing site, he says.

Overall, phishing has been on the decline, especially with two-factor authentication now more commonly in the picture, he says. "We've certainly seen a pretty big drop-off in phishing sites in the last year or two. Two-factor has really cooled off phishing," Anstis says. "Now attackers are moving into taking over a user's actual session. They will wait until they log in rather than capture their usernames, etc."

Trusteer's Boodaei says in these latest real-time phishing attacks, the victims are initially lured to the site with a phishing email posing as their bank, with a phony link to the real-time phishing site. "So as the user tries to log on, the phishing site immediately pushes [their credentials] to the real website, so at the end of the process the fraudsters have an authenticated session with the bank," he says. "This is all taking place in real time."

When the victim gets his OTP via his cell phone, for example, he then types it into the phishing site, assuming all the while that he is on his bank's site. The attackers then use that number before it expires to finalize the authentication process and start their own session with the user's stolen credentials.

He says unlike some phishing gangs that are split into groups who steal credentials and those who buy them to commit the fraud, this attack is waged by a group that both steals the information and commits the fraud.

The underlying problem, meanwhile, is that two-factor authentication can be bypassed, according to security experts. "There are a lot of heads stuck in the sand assuming they are protected," M86's Anstis says.

Aside from locking down the browser, other defensive options include transaction-verification tools. "Two-factor authentication basically has nowhere to go ... to avoid fraudsters from logging onto victims' accounts," Trusteer's Boodaei says. "What banks and other organizations are doing are using various types of verification technology when they [the criminals] actually try to move money out of the account. That won't prevent criminals from logging into your account, but it may prevent them from moving money out."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.