Threat Update: Emergent Capabilities to Bypass Multi Factor Authentication

The development of tactics that undermine multi-factor authentication (MFA)--including MFA implementations that are not SMS based--as a security control is allowing threat actors to access accounts without needing to circumvent each MFA method individually, increasing the risk of account compromise. For greater effectiveness, these tactics are focusing on gaining post-authentication access to those accounts. Some of the methods have advanced session hijacking operations with reverse proxies and ways to easily automate the account compromise cycle. Other methods rely on mobile malware to approve transactions without the user’s knowledge. Both of these capabilities greatly expand upon the limitations of publicized techniques such as SIM swapping, which is not scalable and only defeats SMS-based MFA. While both mobile malware and session hijacking are active and emerging threats, mitigating session hijacking first is likely to result in a larger impact across the threat landscape, primarily due to its likelihood to affect a larger pool of victims and lower point of entry for threat actors.

Recommendations

Technical short term mitigations include:
- looking for specific user agent strings in session connection requests; or
- logging IPs of inbound requests and checking for frequency of use across multiple sessions and the type of infrastructure the IP is associated with.
Long term mitigations to eliminate this threat include:
- Implement FIDO certified U2F hardware keys to prevent session hijacking.
- Provide a downloadable, custom VPN tunnel to connect authorized user devices to the company server.

Details

Threat actors are starting to undermine multi-factor authentication (MFA) as a security control to access accounts and approve transactions rather than trying to circumvent each MFA method individually. The decreasing security of SMS-based authentication is causing users and companies to look for stronger, more robust methods. This, in turn, is driving the next evolution of undermining MFA where hackers and security researchers are finding new methods of bypassing the existing implementation of MFA. Two known approaches to bypassing all MFA including new implementations that are not SMS based are session hijacking and mobile malware.

Session Hijacking

One way threat actors gain post-authentication access is by hijacking a session via a man-in the middle attack. First, threat actors direct users to a phishing page that requests their login credentials. In turn, the phishing page connects with the server of the actual company the users are trying to do business with, forwarding the access request. The company’s server then provides an authenticated session which the threat actor can then steal to gain full access to the users’ accounts. Recently published free open source tools, like Modlishka, Muraena, and Necrobrowser, have advanced this type of attack by creating reverse proxies and ways to automate the whole process. Modlishka, released in January 2019, allows for “real-time phishing” by acting as a reverse proxy; the tool intercepts traffic—including second factor codes from any source—between the user and login pages.

Muraena and NecroBrowser, released in June 2019, work in tandem to automate phishing against MFA. Muraena intercepts traffic between user and target website, and once credentials have been entered, hands off the session data to NecroBrowser, allowing criminals to log in. Combining these tools with readily available and inexpensive phishing techniques means that threat actors of all skill levels are able to carry out these attacks.

We expect an increase in threat actors using session hijacking as more of them become familiar with the free technology and as users and companies move toward complex MFA methods. It is possible that the techniques have already started to gain traction but are not being actively detected due to overall difficulty in identifying the specific techniques.

Malware

Another way threat actors gain access to an account is by compromising a victim’s mobile device with malware. Some types of mobile malware modify a device to allow a hacker to access accounts and approve transactions after the victim logs in. In general these types of malware feature evasion techniques that make them hard to detect, especially if the user does not have antivirus protection--more commonly absent on phones than computers. With mobile banking becoming increasingly prevalent, we expect to see a rise in the development and deployment of malware to capitalize on a wider audience.

Despite the potential increased utility, mobile malware has significant drawbacks. Currently mobile malware requires considerably more technical capabilities and takes longer to develop and deliver than session hijacking. Additionally, the victim pool is generally harder to compromise. Unlike session hijacking which can be deployed against any device, mobile malware must be built for a specific operating system. Even then, users of a targeted operating system are somewhat shielded as malware typically struggles to appear and remain on official app stores, instead preying upon users that download apps from untrusted sources or requiring advanced exploitation that allows for rogue installations.

Mitigations

While both mobile malware and session hijacking present active threats to users and companies, prioritizing session hijacking for mitigation is likely to result in a larger impact across the threat landscape. Proof-of-concept tools that could be used in session hijacking are becoming more common, and motivated attackers could begin utilizing them in MFA bypass efforts. By mitigating session hijacking, organizations can block these potential intrusions before it becomes a common tactic. On the contrary, by first addressing mobile malware, those threat actors--who represent a smaller but more technically capable group--would easily be able to pivot and adopt easier to implement options. Additionally, existing technology supports the prevention of session hijacking, allowing for more rapid implementation.

User-based Controls

One method to prevent session hijacking is to implement FIDO certified U2F hardware keys. This method is effective because its authentication uses an origin-specific key pair that is registered with a particular website. In the situation where a user inputs their credentials into a threat actor’s proxy, the key would not provide the correct key pair since the proxy website requesting the information is different than the target website, even if the user does not notice. An alternative to this is the FIDO 2 standard which operates in a similar way but allows the authentication method to be digitally stored on a device instead of needing a second physical object that a user would be required to carry with them.

Just as cybercriminals are seeking to bypass MFA altogether to compromise accounts, companies can also take measures to bypass phishing altogether to prevent session hijacking. A company could provide users with a downloadable custom VPN tunnel that connects a user’s device to the company’s server. By conditioning users to only use this pre-established means of communication, phishing emails that prompt users to enter their credentials on fake login pages would lose viability. This concept is derived from the popular anti-phishing recommendation that users bookmark login pages to use as pre-established lines of communication to access their accounts. The added benefit here to merely bookmarking a page is that the communication is VPN-protected and therefore would prevent against attacks that are able to intercept traffic coming from a user’s device. This also allows a company to encourage or require the usage of these secure tunnels for a client to do business with them, further increasing effectiveness.

Either of these solutions provide enhanced defenses against MFA bypass attacks but no singular protection measure is foolproof. Layering defenses allows the weakness of one layer to be mitigated by the strengths of another. Pre-established means to communicate only work if the user is not encouraged to connect via compromised methods, whether through social engineering or convenience. While FIDO-certified keys are currently a best practice, flaws or bypasses to them will likely be found eventually. Combining the two, however, and requiring an origin-specific key pair in addition to a VPN would greatly reduce the likelihood a threat actor could compromise both the secure connection and the MFA method to gain access to a session and transfer funds. However, without significant development costs to make this a seamless user experience, the additional friction of this layered technique may increase customer dissatisfaction in the short term.

Network-based Controls

It is also possible to detect and mitigate reverse proxy activity through analysis of a company’s web server logs and subsequent blacklisting. It is likely that requests from a proxy to initially authenticate a session--as well as further attempts to use a session post-authentication--emanate from the same or a limited number of IP addresses. Since this IP information would be logged in connection to multiple victims from likely various geographic locations, configurations could be made to detect the anomalous behavior and corroborate it against IP reputation checks. Those IP addresses can then be blacklisted from the company's server as appropriate.

For the Muranea and NecroBrowser tool set, there are two unique interactions that potentially allow for detection of those tools when used against a company. In Muranea’s configuration files for its proxy, we observed that it has a set of file type exclusions that mainly relate to images, including .ICO files. Since a typical visit by a legitimate user to a website will include a request for the website’s favicon, an .ICO file, the exclusion of this request is an indicator of potential proxy behavior and is detectable in web server logs. Within Necrobrowser’s code, we observed that it includes a unique default useragent string. While default values like this enhance usability for less technical threat actors, they are also indicators that can be blacklisted.

IOCs

Necrobrowser default useragent string Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Zombie/73.0.3683.86 Safari/537.36

Muraena proxy configuration omitted file types "ttf", "otf", "woff", "woff2", "eot", "ase", "art", "bmp", "blp", "cd5", "cit", "cpt", "cr2", "cut", "dds", "dib", "djvu", "egt", "exif", "gif", "gpl", "grf", "icns", "ico", "iff", "jng", "jpeg", "jpg", "jfif", "jp2", "jps", "lbm", "max", "miff", "mng", "msp", "nitf", "ota", "pbm", "pc1", "pc2", "pc3", "pcf", "pcx", "pdn", "pgm", "PI1", "PI2", "PI3", "pict", "pct", "pnm", "pns", "ppm", "psb", "psd", "pdd", "psp", "px", "pxm", "pxr", "qfx", "raw", "rle", "sct", "sgi", "rgb", "int", "bw", "tga", "tiff", "tif", "vtf", "xbm", "xcf", "xpm", "3dv", "amf", "ai", "awg", "cgm", "cdr", "cmx", "dxf", "e2d", "egt", "eps", "fs", "gbr", "odg", "svg", "stl", "vrml", "x3d", "sxd", "v2d", "vnd", "wmf", "emf", "art", "xar", "png", "webp", "jxr", "hdp", "wdp", "cur", "ecw", "iff", "lbm", "liff", "nrrd", "pam", "pcx", "pgf", "sgi", "rgb", "rgba", "bw", "int", "inta", "sid", "ras", "sun", "tga"