Kevin Mitnick, KnowBe4’s Chief Hacking Officer.
And a lot of people ask me, “If they enable two-factor authentication on the websites
that they use, does that stop phishing attacks?”
And let's take a look at that.
So what exactly is two-factor authentication?
That's when you log into a website, for example, and not only do you have to put in your username
and password, but the website actually sends you a code via SMS.
Or you might have an application on your mobile device, that displays a code that you have
to enter into the website to log in.
And that is proving that you actually have your mobile device, so it's a form of authentication
that's based on something that you have, and your password is something that you know.
So a good friend of mine developed this demo, Kuba Gretzky, that demonstrates how a bad
guy could phish you, even though you've enabled two-factor authentication.
So let's take a look at how this works.
So I'm logged into my Gmail account, and if you take a look, on the second email here,
I'll go ahead and open it it appears to be an email from LinkedIn.
And ordinarily, when somebody wants to join your network on LinkedIn, LinkedIn will actually
send an email to your email address, notifying you of that.
And if you're interested, you can go ahead and click interested, log into your LinkedIn
account, and authorize that person to actually become a connection.
So if we take a look here, we have an email from LinkedIn that says, “Kevin I've read
about your adventures in “Ghost in the Wires” and so on,” and this person wants to join
my network.
But this is actually a phishing attack.
If we take a look here, at where the email is originating from, it's not at LinkedIn.com,
it's at this domain called L-L-N-K-E-D.com, which people might overlook.
So let's go ahead and pretend that we're the victim here, and go ahead and click on “interested.”
And what that is going to do, is it's going to redirect us to the LinkedIn website, to
go ahead and login.
But let's move this over to the right, and let that load.
And if you take a look over here, we have a blank, white page, which is going to become
very important in a moment.
And this is the attacker terminal session.
So let's go ahead and bring back the virtual machine that's now connected to LinkedIn to
authenticate, because we again clicked on “interested” in the email.
So we'll go ahead and put in a username, “Johnny-Boy@MitnickSecurity.com” And now we're going to go ahead and put in
our secret password, and then we're gonna go ahead and click sign-in.
And when we click sign-in, it's not going to allow us to login.
What LinkedIn is going to do is request our two-factor authentication code, that LinkedIn
is gonna actually send in my mobile phone.
And in a moment you should hear a sound that the text message received on my mobile phone.
So let's go ahead and click sign-in, and here we go, it's telling us that 2-step authentication
is enabled.
*DING*
We just heard a message come in to my mobile device.
We're gonna uncheck this box, that says, “Recognize this device in the future.”
And I'm gonna open my mobile device, to take a look at and see what the text message, is
or what the code is, rather.
So the code here is “421476.”
We're gonna hit go ahead and click “verify,” and when we do so, it's going to log us into
my LinkedIn account.
So now we're logged into the LinkedIn account, but let's take a look at the attacker session
over here on the left.
So we're gonna scoot this over to the right.
And over here, what we have is what we were able to intercept, so we're able to intercept
the email address which is “Johnny-Boy@MitnickSecurity.com”
We're also able to intercept the password to the account, which is “knowbe4rocks,”
and over here, this is not the actual six digit code that was intercepted, because you
can't really use the six digit code again (the second factor).
But what we were able to do is intercept the session cookie, and if you're able to steal
the session cookie, or if rather the attacker is able to do so, they don't even need your
username or password, or second factor code, they could simply load the session key into
a browser, and they actually become you!
So let me show you how this works, we're gonna highlight the cookie, we're gonna copy it
to the clipboard, and then we're simply going to open up Chrome in incognito mode (and incognito
mode just means “with privacy”)
So now we're gonna go to the REAL LinkedIn website.
When we go here, obviously we're not authenticated, now it wants us to log in with our credentials.
But we don't have to do so, we're gonna go ahead and go into developer tools, we're going
to go into the console, and what we're gonna paste through the console, is the session
cookie that we stole from the victim (which was myself by the way).
I'm gonna enter it.
I'm gonna go ahead and close the session now.
All I simply have to do to be logged into the victim's account with their session cookie,
is simply hit “Refresh” now.
So I hit refresh, and here we are, we're logged in, or rather hacked my own account.
So will two-factor authentication actually stop phishing attacks?
Well you can see that the answer is simply, “no.”
So what do you need to do to protect your organization?
Well of course, you need to have user education and training.
That's a no-brainer.
But you also have to conduct simulated phishing attacks, so you can inoculate your users against
this type of risk.
And more importantly, you have to stop, you have to look and think, before you click that
link.