In early November, Dropbox announced, through a post on its technology blog that it had been the victim of a phishing campaign and that, despite the second authentication factor, cybercriminals were able to hack the company's systems and access sensitive information.
But how was this possible?
The breach was enabled by the use of malicious proxy servers (recently popularized by services such as EvilProxy, on the dark web) that allowed attackers to obtain a valid user session, meaning more than access to user credentials, it was possible to obtain session cookies containing authentication tokens, used by browsers and services to determine a user's valid identity.
The technique used by EvilProxy, other platforms for phishing-as-a-service or even open-source projects such as evilginx2 exploits its position as a node in the communication chain between users and legitimate services and allows even people without technical knowledge to steal authentication tokens and bypass multifactor authentication (MFA) on services such as Apple, Google, Facebook, Twitter, GitHub, GoDaddy, and others.
This attack exploits an architectural characteristic of authentication systems. When we log in to a system, we provide a username and password along with other security factors, such as a numeric code or authentication on another device, right?
Once this initial authentication is complete, that is, for all traffic after the initial login, the device we are using exchanges an access or session key without us noticing with the website or server we are using, depending on the architecture. This access key is precisely what attackers now seek, rather than the various authentication factors needed to obtain it.
Criminals are taking a shortcut, positioning themselves between users and the systems they are trying to access and capturing session keys after initial authentication and use of multiple authentication factors.
A critical risk, rarely mapped
Although critical, this imminent risk is not on companies' radar because it is not covered in the test scenarios performed and, when it is, no evidence is generated of the actual potential impact of cyberattacks that use the technique.
The fact is that a traditional phishing simulation, widely used by companies to measure engagement, click rates, and the number of credentials captured does not convey the actual impact of a kill chain that only begins with a fraudulent email campaign.
Consider this: if only one person among 2,000 employees has their credentials obtained by the simulated phishing campaign, this might be considered a good result. But what if that particular person has access to the company's critical systems and data? What if, using that single obtained credential, an attacker can turn the risk of a destructive attack into reality?
This is why the traditional approach urgently needs to change. Phishing campaigns should include a simulation of AiTM techniques (adversary-in-the-middle), as well as an incursion by the red team that can exploit kill chains by obtaining a credential.
Focusing on awareness remains the first line of defense, but applying this new approach provides valuable insights that help improve the cybersecurity posture of systems that could be compromised through simulated phishing, as well as identifying the need to adopt additional defensive layers such as inspection of endpoints and source-based access restrictions, for example. The high frequency and success rates of social engineering attacks using this new technique of phishing against major companies that naturally have a high level of cybersecurity maturity (Microsoft in the Bing source code leak and now Dropbox, for example) should establish that the risk is critical and deserves greater attention in defense strategies.
