By now, you probably have logged into your email, or your social media, or online bank
account, and you've been prompted to create a second step to verify your identity -- it's
called two-factor authentication, and it's an extra layer of security that more and more
companies are using to protect customer accounts.
But it turns out hackers have already figured out a way to bypass that feature, Andrea Day
explains.
Username, password, and now for extra security, two-factor authentication typically a special
code sent to your smartphone, enter it in, and you're good to go, right?
“Just by enabling two-factor authentication, you can't relax.”
Meet Kevin Mitnick, once one of the FBI's most wanted hackers.
He's now the Chief Hacking Officer at cybersecurity firm, KnowBe4.
“Even though you're using two-factor authentication, a smart attacker could get access to your
account.”
It could open up your personal accounts or business files to criminals, and here's the
scary part!
“The tool to actually pull these attacks off has been made public, so any 13-year-old
could download the tool, and actually carry out these attacks.”
KnowBe4’s CEO Stu Sjouwerman.
“It's happening as we speak.”
He says the attack banks on social engineering, that's where hackers take advantage of human
behavior to get you to do something, like click on a link.
“Social engineering, if you do it right, can be used to get into almost anything.”
And in this case, even your two-factor authentication won't keep them out.
Here's how it works: Mitnick says the bad guys start by sending you a phony email, that
looks like the real deal!
It's called “phishing.”
In this demo, the fake email is from “LinkedIn,” saying a fan wants to connect.
He clicks the link, and is directed to the real LinkedIn page.
“Now LinkedIn basically brought up a message that I have to enter my two-factor code.
The code is sent to his device.
“Ah, now I got the message.”
He enters the code.
“And now I'm logged in.”
But now the bad guys can log in too.
Here's how before he was directed to LinkedIn, it secretly went through the hackers server,
where it left what's called a “cookie” -- that's a bunch of info about Mitnick, like
his username and password, and all hackers need to get in.
“Now when I hit refresh, I'm gonna be magically logged into the victim’s account, without
needing a password their username or even their two-factor code.”
His advice?
Learn how to spot those phony emails, and never click on a link, unless you're 100%
sure.
“It's not LinkedIn that's vulnerable, it's the actual user.
It's a security flaw with the human.”
Take a close look at our demo, the email came from a fake domain, not LinkedIn but “L-L-N-K-E-D.COM,”
which people initially might not even realize.
LinkedIn tells us, “We take these types of reports very seriously, and have a number
of technical measures in place to protect our members.
When we detect this type of activity, we work to quickly remove it and prevent future reoccurrences.
We strongly encourage members to report any messages or postings they believe are scams.
Companies like Google and others now have tools to try and prevent it.
It's called a security key, and here's how it works: Director of Product Management,
Marc Risher.
“The security key stores its own password and requires the site to prove that it's legitimate
before releasing that password and getting you signed in.”
And while they've made strides, he says there are still open areas.
“It's not ubiquitous by a long shot, but we're encouraged to see more and more sites,
more and more apps, and also more and more hardware manufacturers come online and make
these products.”
And the solutions may be one step closer, but the pros say that YOU still need to play
a role, and pay close attention to everything you enter, even with that special code.
For Nightly Business Report, I'm Andrea Day.