John Leonard<p>Phishing-as-a-service is an area that is increasing rapidly according to research by security vendor Barracuda Networks, which says it has detected a “massive spike” in PhaaS attacks in the first two months of this year.</p><p><a href="https://www.computing.co.uk/news/2025/security/massive-spike-in-phishing-as-a-service-attacks-in-2025-research" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">computing.co.uk/news/2025/secu</span><span class="invisible">rity/massive-spike-in-phishing-as-a-service-attacks-in-2025-research</span></a></p><p><a href="https://mastodon.social/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>phishing</span></a> <a href="https://mastodon.social/tags/phaas" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>phaas</span></a> <a href="https://mastodon.social/tags/tycoon2fa" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>tycoon2fa</span></a> <a href="https://mastodon.social/tags/evilproxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>evilproxy</span></a> <a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://mastodon.social/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.social/tags/barracuda" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>barracuda</span></a> <a href="https://mastodon.social/tags/technews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>technews</span></a></p>
med-mastodon.com is one of the many independent Mastodon servers you can use to participate in the fediverse.
Medical community on Mastodon
Administered by:
Server stats:
362active users
med-mastodon.com: About · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.1
#evilproxy
0 posts · 0 participants · 0 posts today
Erik van Straten<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@patrickcmiller" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>patrickcmiller</span></a></span> : oops, from <a href="https://www.csoonline.com/article/3810936/us-takes-aim-at-healthcare-cybersecurity-with-proposed-hipaa-changes.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">csoonline.com/article/3810936/</span><span class="invisible">us-takes-aim-at-healthcare-cybersecurity-with-proposed-hipaa-changes.html</span></a>:</p><p>"the rollout of multi-factor authentication as a defense against phishing"</p><p>What part of <a href="https://infosec.exchange/tags/Evil" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Evil</span></a> <a href="https://infosec.exchange/tags/Proxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Proxy</span></a> do these people not understand?</p><p><a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhaaS</span></a> <a href="https://infosec.exchange/tags/EvilGinx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilGinx2</span></a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Weak2FA</span></a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WeakMFA</span></a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/TwoStepVerification" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TwoStepVerification</span></a> <a href="https://infosec.exchange/tags/FakeWebsite" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FakeWebsite</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MitM</span></a></p>
Erik van Straten<p><span class="h-card" translate="no"><a href="https://mastodon.nl/@jasper" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>jasper</span></a></span> : okay, ik heb geprofiteert van een "sponsored item" ;-)</p><p>Maar met de stukjes die ik aanhaalde ben ik het volledig eens.</p><p>Als ik dan zie dat de Radboud Universiteit nu MFA verplicht (voor eduVPN: <a href="https://www.ru.nl/over-ons/nieuws/veiliger-inloggen-bij-eduvpn" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">ru.nl/over-ons/nieuws/veiliger</span><span class="invisible">-inloggen-bij-eduvpn</span></a>) dan heb ik toch sterk mijn twijfels (SMS toestaan is helemaal opmerkelijk). Als ik het goed begrijp is eduVPN gebaseerd op OpenVPN, met als basis een sterke private key op jouw device. Als dat device gecompromitteerd is ben je meestal sowieso de Sjaak.</p><p>MFA (of 2FA) is symptoombestrijding voor zwakke en/of hergebruikte wachtwoorden, en introduceert een berg nieuwe problemen (die de meeste voorstanders luidkeels verzwijgen).</p><p>Mocht iemand toch een TOTP app willen gebruiken, blijf dan ver weg bij Authy (een privacy- en security-drama [1]). AEGIS is open source. Denk er wel om dat je zelf betrouwbare backups van de bijbehorende database (*) moet maken.</p><p>(*) In die database zitten "shared secrets", per account een uniek soort "wachtwoord" dat zowel jouw app als de server met jouw account "kennen". De app "verhaspelt" dat geheim met de actuele datum en tijd, en kort het resultaat in tot een beperkt aantal cijfers; de server doet precies hetzelfde (de server doet dat meestal voor verschillende tijdstippen omtreeks het huidige, omdat klokken soms onvoldoende gelijk lopen).</p><p>[1] <a href="https://security.nl/posting/796625" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">security.nl/posting/796625</span><span class="invisible"></span></a> en specifiek m.b.t. Authy: <a href="https://tweakers.net/nieuws/207532/#r_18549330" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">tweakers.net/nieuws/207532/#r_</span><span class="invisible">18549330</span></a> (sinds ik daar weg ben en geen ErikvanStraten meer heet, zijn al mijn reacties ooit op die site te herkennen aan "Anoniem: 1576590").</p><p><a href="https://infosec.exchange/tags/Authy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Authy</span></a> <a href="https://infosec.exchange/tags/AEGIS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AEGIS</span></a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TOTP</span></a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SMS</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/EvilGinx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilGinx2</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a></p>
Erik van Straten<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@adamshostack" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>adamshostack</span></a></span> : not taking into account that I strongly advise against using weak MFA (because it it not phishing-resistant and comes with a lot of disadvantages "security experts" want nobody to know about):</p><p>yes.</p><p>See <a href="https://www.oasis.security/resources/blog/oasis-security-research-team-discovers-microsoft-azure-mfa-bypass" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">oasis.security/resources/blog/</span><span class="invisible">oasis-security-research-team-discovers-microsoft-azure-mfa-bypass</span></a> (yesterday).<br>Source: <a href="https://infosec.exchange/@AAKL/113634744971043868" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec.exchange/@AAKL/1136347</span><span class="invisible">44971043868</span></a></p><p>In short (if I understand correctly) Microsoft's servers would accept codes in a time window for upto 3 minutes. This enabled the researchers to conduct a brute force attack.</p><p><a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WeakMFA</span></a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Weak2FA</span></a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TOTP</span></a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SMS</span></a> <a href="https://infosec.exchange/tags/Voice" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Voice</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MitM</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Evilginx2</span></a></p>
Erik van Straten<p><span class="h-card" translate="no"><a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>GossiTheDog</span></a></span> : it's not the lack of MFA that is the problem.</p><p>Problem 1) is that a SPOF (*) is permitted access to data of millions (either directly or indirectly). This risk includes compromise of client devices.</p><p>2) Weak MFA (+) does not prevent these attacks, because the SPOF may be phished into entering their credentials in a third party page that imitates the intended Citrix Netscaler.</p><p>Please do not promote a flawed fix for bad passwords (2019: <a href="https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">techcommunity.microsoft.com/t5</span><span class="invisible">/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124</span></a>).</p><p>(*) Single Point Of Failure</p><p>(+) SMS, Voice, TOTP, Number Matchting, Location</p><p><a href="https://infosec.exchange/tags/AllYourCredsAreBelongToUs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AllYourCredsAreBelongToUs</span></a> <a href="https://infosec.exchange/tags/MFAHadFailed" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFAHadFailed</span></a> <a href="https://infosec.exchange/tags/AlexWeinert" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AlexWeinert</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WeakMFA</span></a> <a href="https://infosec.exchange/tags/NumberMatching" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NumberMatching</span></a> <a href="https://infosec.exchange/tags/AlexWeinert" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AlexWeinert</span></a> <a href="https://infosec.exchange/tags/Weinert" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Weinert</span></a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SMS</span></a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TOTP</span></a> <a href="https://infosec.exchange/tags/EvilGinx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilGinx2</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhaaS</span></a></p>
Erik van Straten<p>Hoe de Politiehack precies heeft plaatsgevonden, weet ik niet.</p><p>Wel weet ik dat veel "experts"hun kop in het zand steken of mij zelfs voor gek verklaren als ik schrijf dat:</p><p>1) Het opzet is dat mensen op internet nep niet van echt kunnen onderscheiden (<a href="https://security.nl/posting/859906/Speculatie_over_Politie-hack" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.nl/posting/859906/Spe</span><span class="invisible">culatie_over_Politie-hack</span></a>), en dat daar *dringend* iets aan gedaan moet worden;</p><p>2) Zij aanraden om zwakke MFA (<a href="https://security.nl/posting/859561/MFA-2FA_is_als_peniciline" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">security.nl/posting/859561/MFA</span><span class="invisible">-2FA_is_als_peniciline</span></a>) te gebruiken in plaats van een wachtwoordmanager die op domeinnamen checkt;</p><p>3) Onder hen er *zelfs* zijn die stellen dat we, op *dit* internet, EDIW veilig zouden kunnen gebruiken (reactie op een posting van Ivo Jansch, één van de architecten van EDIW: <a href="https://tweakers.net/nieuws/204138/#r_18249704" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">tweakers.net/nieuws/204138/#r_</span><span class="invisible">18249704</span></a>). Welliswaar met de opmerking dat er alternatieven moeten blijven bestaan (die er nu ook niet meer zijn voor communicatie met de overheid of met uw bank).</p><p>Zie ook <a href="https://www.security.nl/posting/827137/Kopie-ID-Kap-Ermee#posting833162" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">security.nl/posting/827137/Kop</span><span class="invisible">ie-ID-Kap-Ermee#posting833162</span></a>, bovenaan die pagina en <a href="https://www.security.nl/posting/833217/Internet-toenemende_impersonatie" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">security.nl/posting/833217/Int</span><span class="invisible">ernet-toenemende_impersonatie</span></a>.</p><p><a href="https://infosec.exchange/tags/Politiehack" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Politiehack</span></a> <a href="https://infosec.exchange/tags/Politie" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Politie</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/ZwakkeMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ZwakkeMFA</span></a> <a href="https://infosec.exchange/tags/Zwakke2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Zwakke2FA</span></a> <a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DV</span></a> <a href="https://infosec.exchange/tags/Certificaten" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Certificaten</span></a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LetsEncrypt</span></a> <a href="https://infosec.exchange/tags/LetsAuthenticateTheWebsiteFirst" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LetsAuthenticateTheWebsiteFirst</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MitM</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhaaS</span></a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Evilginx2</span></a> <a href="https://infosec.exchange/tags/EDIW" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EDIW</span></a> <a href="https://infosec.exchange/tags/EUDIW" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EUDIW</span></a> <a href="https://infosec.exchange/tags/EC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EC</span></a> <a href="https://infosec.exchange/tags/KopieID" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>KopieID</span></a> <a href="https://infosec.exchange/tags/KopietjePaspoort" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>KopietjePaspoort</span></a> <a href="https://infosec.exchange/tags/VideoIdent" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VideoIdent</span></a> </p><p>(Bron van onderstaand plaatje: <a href="https://www.maxvandaag.nl/sessies/themas/media-cultuur/waarom-steken-we-ons-hoofd-in-het-zand-als-het-lastig-wordt/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">maxvandaag.nl/sessies/themas/m</span><span class="invisible">edia-cultuur/waarom-steken-we-ons-hoofd-in-het-zand-als-het-lastig-wordt/</span></a>)</p>
Erik van Straten<p><span class="h-card" translate="no"><a href="https://xn--8r9a.com/@north" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>north</span></a></span> : SMS *is* 2FA, albeit weak.</p><p>The problem with "something you know, are, or have" is that users are never told that it is essential that each factor used cannot be easily copied, stolen, guessed etc. or temporarily fall into the wrong hands (literally in this case).</p><p>Another problem is that if you loose a factor, you may no longer have access to your account.</p><p>So each factor must be strong, carefully kept secret and needs to be backupped. These are extreme requirements that nobody wants (you) to understand.</p><p>P.S. both iPhones and Android phones can be configured to *not* show SMS texts (and most other possibly confidential information) on their screen when locked.</p><p>P.P.S. Unlocked phones are vulnerable to Time Traveler TOTP attacks. An attacker with temporary access to an unlocked phone may change the system date/time to the future, read a TOTP code for a website, and restore correct system time. When the future arrives they can use your TOTP code at their leisure on their own device to log in to your account, and reuse it (within 30 sec.) if required to pwn your account.</p><p>P.P.P.S. Weak 2FA/MFA does not prevent AitM (Attacker in the Middle) phishing attacks if the AitM uses Evilginx2 or some other "evil proxy" website.</p><p>2019 "MFA had failed" (by Alex Weinert, Director of Identity Security at Microsoft) <a href="https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">techcommunity.microsoft.com/t5</span><span class="invisible">/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124</span></a></p><p><span class="h-card" translate="no"><a href="https://infosec.exchange/@acut3hack" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>acut3hack</span></a></span> </p><p><a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SMS</span></a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TOTP</span></a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WeakMFA</span></a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Weak2FA</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MitM</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Evilginx2</span></a> <a href="https://infosec.exchange/tags/TimeTravelerAttacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TimeTravelerAttacks</span></a> <a href="https://infosec.exchange/tags/TimeTravelAttacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TimeTravelAttacks</span></a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhaaS</span></a></p>
Erik van Straten<p>In *2019*, Alex Weinert of Microsoft wrote in <a href="https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">techcommunity.microsoft.com/t5</span><span class="invisible">/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124</span></a>:</p><p>«<br> MFA had failed.</p><p> [...]<br> All Authenticators Are Vulnerable<br> [...]<br>»</p><p>Today, as echoed in <a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-enable-mfa-or-lose-access-to-admin-portals-in-october/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/micr</span><span class="invisible">osoft/microsoft-enable-mfa-or-lose-access-to-admin-portals-in-october/</span></a>, Microsoft still insists that using weak MFA is a good idea.</p><p>In <a href="https://azure.microsoft.com/en-us/blog/announcing-mandatory-multi-factor-authentication-for-azure-sign-in/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">azure.microsoft.com/en-us/blog</span><span class="invisible">/announcing-mandatory-multi-factor-authentication-for-azure-sign-in/</span></a> Microsoft writes (on August 15):</p><p>«<br>As recent research [1] by Microsoft shows that multifactor authentication (MFA) can block more than 99.2% of account compromise attacks, making it one of the most effective security measures available, today’s announcement brings us all one step closer toward a more secure future.<br>»</p><p>From that same article, "solutions" with (nearly as weak as SMS) "Microsoft Authenticator" is at the TOP of their list:</p><p>«<br>Organizations have multiple ways to enable their users to utilize MFA through Microsoft Entra:</p><p>• Microsoft Authenticator [...]<br>• FIDO2 security keys [...]<br>• Certificate-based authentication [...]<br>• Passkeys [...]<br>• Finally, and this is the least secure version of MFA, you can also use a SMS or voice approval [...]<br>»</p><p>From [1] (PDF) = <a href="https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW166lD?culture=en-us" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">query.prod.cms.rt.microsoft.co</span><span class="invisible">m/cms/api/am/binary/RW166lD?culture=en-us</span></a> , no date of the "investigation period" to be seen *anywhere*, and one of the authors being Alex Weinert, more extreme percentages (approved by Microsoft's marketing dept):</p><p>« <br>Our findings reveal that MFA implementation offers outstanding protection, with over 99.99% of MFA-enabled accounts remaining secure during the investigation period. Moreover, MFA reduces the risk of compromise by 99.22% across the entire population and by 98.56% in cases of leaked credentials.<br>»</p><p>Dear reader: please stop buying Microsoft BS that completely ignores PhaaS.</p><p>To name a few examples:</p><p>🚨 "Experts agree [*] that setting up two-factor authentication (2FA) İs one of the most powerful ways to protect your account from getting hacked. However, hackers like COLDRIVER and COLDWASTREL may try to trick you into entering your second factor; we have seen attackers successfully compromise a victim who had enabled 2FA." - (PDF) <a href="https://www.accessnow.org/wp-content/uploads/2024/08/Spearphishing-cases-in-Eastern-Europe-2022-2024-technical-brief.pdf" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">accessnow.org/wp-content/uploa</span><span class="invisible">ds/2024/08/Spearphishing-cases-in-Eastern-Europe-2022-2024-technical-brief.pdf</span></a></p><p>[*] Not me. My tip is here: <a href="https://infosec.exchange/@ErikvanStraten/112724966066248808" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">infosec.exchange/@ErikvanStrat</span><span class="invisible">en/112724966066248808</span></a></p><p>🚨 EvilGinx2: "Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication" - <a href="https://github.com/kgretzky/evilginx2" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">github.com/kgretzky/evilginx2</span><span class="invisible"></span></a> (there are more, like Modlishka, Muraena, CredSniper, EvilProxy (Phaas), NakedPages etc.)</p><p>🚨 Not even a fake website needed: <a href="https://www.bleepingcomputer.com/news/security/new-greatness-service-simplifies-microsoft-365-phishing-attacks/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/new-greatness-service-simplifies-microsoft-365-phishing-attacks/</span></a></p><p>🚨 From <a href="https://mrd0x.com/attacking-with-webview2-applications/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">mrd0x.com/attacking-with-webvi</span><span class="invisible">ew2-applications/</span></a>:<br>«<br>Bypass 2FA<br>WebView2 also provides built-in functionality to extract cookies. This allows an attacker to extract cookies after the user authenticates into the legitimate website. This technique removes the need of having to spin up Evilginx2 or Modlishka but the obvious trade-off is that the user must execute the binary and authenticate.<br>»<br>In addition, from <a href="https://www.bleepingcomputer.com/news/security/clever-phishing-method-bypasses-mfa-using-microsoft-webview2-apps/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/clever-phishing-method-bypasses-mfa-using-microsoft-webview2-apps/</span></a>:<br>«<br>"Yubikeys can't save you because you're authenticating to the REAL website not a phishing website."<br>mr.d0x<br>»<br>AND:<br>«<br>However, as mr.d0x admits and Microsoft pointed out in their response to our questions, this attack is a social engineering attack and requires a user to run a malicious executable.<br>»<br>Correct, but a local compromise does'nt protect you when you're using FIDO2 hardware keys or passkeys.</p><p>🚨 From 2022: <a href="https://microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">microsoft.com/en-us/security/b</span><span class="invisible">log/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/</span></a>:<br>«<br>A large-scale phishing campaign that used adversary-in-the-middle (AiTM) phishing sites stole passwords, hijacked a user’s sign-in session, and skipped the authentication process even if the user had enabled multifactor authentication (MFA).<br>»</p><p>🚨 "Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling" - <a href="https://www.netskope.com/blog/phishing-with-cloudflare-workers-transparent-phishing-and-html-smuggling" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">netskope.com/blog/phishing-wit</span><span class="invisible">h-cloudflare-workers-transparent-phishing-and-html-smuggling</span></a></p><p>🚨 "New EvilProxy Phishing Service Allowing Cybercriminals to Bypass 2-Factor Security" - <a href="https://thehackernews.com/2022/09/new-evilproxy-phishing-service-allowing.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thehackernews.com/2022/09/new-</span><span class="invisible">evilproxy-phishing-service-allowing.html</span></a></p><p>🚨 From <a href="https://www.europol.europa.eu/media-press/newsroom/news/international-investigation-disrupts-phishing-service-platform-labhost" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">europol.europa.eu/media-press/</span><span class="invisible">newsroom/news/international-investigation-disrupts-phishing-service-platform-labhost</span></a>:<br>«<br>The investigation uncovered at least 40 000 phishing domains linked to LabHost, which had some 10 000 users worldwide.<br>[...]<br>LabRat was designed to capture two-factor authentication codes and credentials, allowing the criminals to bypass enhanced security measures.<br>»</p><p>🚨 "Security and Privacy Failures in Popular 2FA Apps" by Gilsenan et al. (USENIX 2023): <a href="https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">usenix.org/conference/usenixse</span><span class="invisible">curity23/presentation/gilsenan</span></a><br>The PDF can also be found here: <a href="https://github.com/blues-lab/totp-app-analysis-public" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/blues-lab/totp-app-</span><span class="invisible">analysis-public</span></a> (Aegis was one of the least problematic apps, and don't use Authy).</p><p>This is what is wrong with weak MFA/2FA:</p><p> You<br> o<br> /|\ [device + browser]<br> / \ |<br> v<br> [login.microsoftonline-aitm.com]<br> |<br> v<br> [login.microsoftonline.com]</p><p>(no thanks to DV-certificates).</p><p><a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MitM</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhaaS</span></a> <a href="https://infosec.exchange/tags/Authenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Authenticator</span></a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TOTP</span></a> <a href="https://infosec.exchange/tags/OTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OTP</span></a> <a href="https://infosec.exchange/tags/MicrosoftAuthenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MicrosoftAuthenticator</span></a> <a href="https://infosec.exchange/tags/Authy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Authy</span></a> <a href="https://infosec.exchange/tags/Aegis" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Aegis</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/WebView" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WebView</span></a> <a href="https://infosec.exchange/tags/AitB" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitB</span></a> <a href="https://infosec.exchange/tags/MitB" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MitB</span></a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Impersonation</span></a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Authentication</span></a> <a href="https://infosec.exchange/tags/Trust" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Trust</span></a> <a href="https://infosec.exchange/tags/TrustWorthyNess" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TrustWorthyNess</span></a> <a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DV</span></a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PasswordManager</span></a> <a href="https://infosec.exchange/tags/CheckDomainName" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CheckDomainName</span></a> <a href="https://infosec.exchange/tags/DomainNameCheck" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DomainNameCheck</span></a></p>
Erik van Straten<p>Don't rely on 2FA!</p><p>Instead use a trustworthy & secure pwmgr (password manager) that checks the domain name (like passkeys do implicitly) and, based on that, offers to autofill credentials.</p><p>And:<br>• Let the pwmgr generate random long unique passwords for each account;</p><p>• Back up the pw db (database) after each change (and have multiple physical locations where those back ups are stored);</p><p>• Know what to do when logging in to a website and your pwmgr comes up with *NOTHING* : don't search for credentials in de pw db for the website you were made to *believe* it is - it's fake.</p><p><<< The phishing page, for its part, urges the victim to sign in with Microsoft Outlook or Office 365 (now Microsoft 365) to view a purported PDF document. Should they follow through, fake sign-in pages hosted on Cloudflare Workers are used to harvest their credentials and multi-factor authentication (MFA) codes. >>> <a href="https://thehackernews.com/2024/05/new-tricks-in-phishing-playbook.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">thehackernews.com/2024/05/new-</span><span class="invisible">tricks-in-phishing-playbook.html</span></a></p><p><span class="h-card" translate="no"><a href="https://infosec.exchange/@patrickcmiller" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>patrickcmiller</span></a></span> </p><p><a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/2FAFail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FAFail</span></a> <a href="https://infosec.exchange/tags/MFAFail" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFAFail</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhaaS</span></a> <a href="https://infosec.exchange/tags/Cloudflare" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cloudflare</span></a> <a href="https://infosec.exchange/tags/CloudflareWorkers" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CloudflareWorkers</span></a> <a href="https://infosec.exchange/tags/CyberCrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberCrime</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/2FAPhishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FAPhishing</span></a> <a href="https://infosec.exchange/tags/MFAPhishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFAPhishing</span></a></p>
Erik van Straten<p>2FA (MFA) beschermt *niet* tegen steeds meer phishingaanvallen:</p><p><<<Tycoon 2FA operates as an adversary-in-the-middle (AitM) phishing kit. Its primary function is to harvest Microsoft 365 and Gmail session cookies. >>><br><a href="https://www.proofpoint.com/us/blog/email-and-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">proofpoint.com/us/blog/email-a</span><span class="invisible">nd-cloud-threats/tycoon-2fa-phishing-kit-mfa-bypass</span></a></p><p>U kunt zichzelf hier prima tegen beschermen, zonder passkeys of software van bijvoorbeeld Proofpoint te gebruiken: zie <a href="https://security.nl/posting/841126" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">security.nl/posting/841126</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>2FA</span></a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>MFA</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AitM</span></a> <a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Passkeys</span></a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PasswordManager</span></a> <a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Passwords</span></a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Phishing</span></a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PhaaS</span></a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> <a href="https://infosec.exchange/tags/EvilGinx" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilGinx</span></a> <a href="https://infosec.exchange/tags/EvilGinx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilGinx2</span></a> <a href="https://infosec.exchange/tags/Tycoon" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Tycoon</span></a> <a href="https://infosec.exchange/tags/Proofpoint" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Proofpoint</span></a></p>
securityaffairs<p><a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> used in massive cloud account takeover scheme<br><a href="https://securityaffairs.com/149348/hacking/cloud-account-takeover-scheme-evilproxy.html" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">securityaffairs.com/149348/hac</span><span class="invisible">king/cloud-account-takeover-scheme-evilproxy.html</span></a><br><a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>securityaffairs</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>phishing</span></a></p>
Taylor Parizo<p>From the <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>EvilProxy</span></a> Telegram channel: <br>It appears they're using <a href="https://auth.acme-dns.io/" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="">auth.acme-dns.io/</span><span class="invisible"></span></a> as their way of generating subdomains. <br>"Hi friends, we have problem with add new domains in system bcs 3party website is down (<a href="https://auth.acme-dns.io" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="">auth.acme-dns.io</span><span class="invisible"></span></a>) if some one has info what's wrong with it share pls. we are looking for tmp solution."</p><p>As of now the site is still down. Returning 404. <span class="h-card"><a href="https://infosec.exchange/@DomainTools" class="u-url mention" rel="nofollow noopener" target="_blank">@<span>DomainTools</span></a></span> shows a pDNS record from the acme resolved IP that uses the same subdomain pattern seen in EvilProxy phishing campaigns. </p><p><a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatHunting</span></a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DNS</span></a> <a href="https://infosec.exchange/tags/OSINT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OSINT</span></a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload