Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Fake Login. Show all posts
User Security
blob URIs Cyber Fraud Fake Login Phishing Campaign User Security

Cybercriminals Employ Display Fake Login Pages in Your Browser

 

Cofense Intelligence cybersecurity researchers have discovered a new and increasingly successful technique that attackers are using to deliver credential phishing pages straight to users' email inboxes. 

This technique, which first surfaced in mid-2022, makes use of "blob URIs" (binary large objects-Uniform Resource Identifiers), which are addresses that point to temporary data saved by your internet browser on your own computer. Blob URIs have legitimate uses on the internet, such as YouTube temporarily storing video data in a user's browser for playback.

A key feature of blob URIs is their localised nature; that is, a blob URI created by one browser cannot be viewed by another, even on the same device. This inherent privacy feature, while advantageous for legal online services, has been abused by attackers for malicious objectives.

Cofense Intelligence's report, which was shared with Hackread.com, claims that security systems that monitor emails are unable to easily detect the malicious phoney login pages since Blob URI data isn't on the regular internet. As a result, the link in a phishing email does not lead directly to a fraudulent website. Instead, it directs you to a real website that the security systems trust, such as OneDrive from Microsoft. 

Subsequently, the user is directed to an attacker-controlled hidden webpage. The phoney login page is then created in your browser by this hidden website using a blob URI. This page can steal your username and password and send it to the cybercriminals even though it is only saved on your system. 

This poses a challenge for automated security systems, particularly Secure Email Gateways (SEGs), which analyse website content to detect phishing efforts, the researchers explained. AI-powered security models may not yet be sufficiently trained to differentiate between benign and malevolent usage due to the novelty of phishing attacks employing blob URIs. 

The lack of pattern recognition makes automated detection more difficult and raises the possibility that phishing emails will evade protection, especially when paired with the popular attacker technique of employing several redirects.

Cofense Intelligence has detected many phishing attempts using this blob URI method, with lures aimed to fool users into logging in to fraudulent versions of popular services such as OneDrive. These entices include notifications of encrypted messages, urges to access Intuit tax accounts, and financial institution alerts. Regardless of the many initial pretexts, the overall attack flow is similar.

Researchers worry that this sort of phishing may become more common due to its ability to bypass security. As a result, even if links in emails appear to lead to legitimate websites, it is critical to exercise caution and double-check before entering your login details. Seeing "blob:http://" or "blob:https://" in the webpage address may indicate this new trick.
Read more »
Spam Notification
Cyber Attacks Fake Login MFA Fatigue Attacks Notifications Spam Notification

Users Duped into Enabling Device Access Due to Overload of Push Notifications

 

Malicious hackers are initiating a new wave of 'MFA fatigue attacks,' in which they bombard victims with 2FA push alerts in an attempt to mislead them into authenticating their login attempts. 

According to GoSecure experts, who have warned that attacks that take advantage of human behaviour to get access to devices are on the upswing. Adversaries employ multi-factor authentication (MFA) fatigue to bombard a user's authentication app with push notifications in the hopes that they will accept and so allow an attacker to obtain access to an account or device. GoSecure described the assault as "simple" in a blog post earlier this week, noting that "it only requires the attacker to manually, or even automatically, send repeated push notifications while trying to log into the victim’s account”. 

Further, it added, “Once the attacker obtains valid credentials, they will perform the push notification spamming repeatedly until the user approves the login attempt and lets the attacker gain access to the account. This usually happens because the user is distracted or overwhelmed by the notifications and, in some cases, it can be misinterpreted as a bug or confused with other legitimate authentication requests.” 

The attack is exceptionally effective, according to GoSecure, not because of the technology involved, but because it exploits the human component through social engineering. 

Researchers wrote, “Many MFA users are not familiar with this type of attack and would not understand they are approving a fraudulent notification. Others just want to make it disappear and are simply not aware of what they are doing since they approve similar notifications all the time. They can’t see through the ‘notification overload’ to spot the threat.” 

The approach has been seen in the wild in recent years, including during a 2021 campaign in which Russian operators were seen sending push alerts to Office 365 users. Threat actors were spotted performing repeated authentication attempts in short succession against accounts secured with MFA, according to Mandiant research. 

A blog post reads, “In these cases, the threat actor had a valid username and password combination. Many MFA providers allow users to accept a phone app push notification or to receive a phone call and press a key as a second factor. The threat actor took advantage of this and issued multiple MFA requests to the end user’s legitimate device until the user accepted the authentication, allowing the threat actor to eventually gain access to the account.” 

The researchers also explained how an Office 365 user might detect numerous push notification attempts and how to protect themselves from such assaults. For example, a user might set the MFA service's default limits to allow a specific number of push notification attempts in a certain amount of time. 

GoSecure explained, “In this scenario, a unique two-digit number is generated and must be confirmed on both sides. This is very hard for an attacker to compromise since the attacker is shown a number that must be guessed in the phone (which the attacker doesn’t have access to)." Finally, a “radical move, but a quick solution” could be to disable the push notifications entirely. 

GoSecure also warned, “As app-based authentication mechanisms are being adopted increasingly as a safer way to authenticate a user (versus SMS or phone call) it is expected that this tendency will grow in the future, even be encouraged by Microsoft itself.”
Read more »
Subscribe to: Posts (Atom)