<story><title>The Rise of One-Time Password Interception Bots</title><url>https://krebsonsecurity.com/2021/09/the-rise-of-one-time-password-interception-bots/</url></story><parent_chain><item><author>julianlam</author><text>I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account.&lt;p&gt;The fault here lies with victims answering a prompt to enter their 2FA out of the blue. Just as with passwords and other such info, the bank will never request it for no reason.&lt;p&gt;A hardware token using webauthn protocol is most secure though, yes.</text></item><item><author>hannob</author><text>Ultimately what this shows is that two factor authentication with either TOTP (aka Google Authenticator) or SMS is not ideal. It makes phishing harder for the attacker, but it does not prevent it.&lt;p&gt;Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol.</text></item></parent_chain><comment><author>jrochkind1</author><text>In the linked article on the words &amp;quot;the scammers can get around that, too&amp;quot; [1], there&amp;#x27;s an account that claims the legit bank &lt;i&gt;did&lt;/i&gt; in the past ask for the 2FA on a phone call, in pretty much exactly the same way the scammers did.&lt;p&gt;&amp;gt; &lt;i&gt;Mitch said his financial institution has in the past verified his identity over the phone by sending him a one-time code to the cell phone number on file for his account, and then asking him to read back that code.&lt;/i&gt;&lt;p&gt;The advice from Krebs about phone calls is &lt;i&gt;never&lt;/i&gt; talk to &amp;quot;the bank&amp;quot; (etc) when &lt;i&gt;they call you&lt;/i&gt;, always you have to call them back.  But the bank _will_ really sometimes contact you &amp;quot;out of the blue&amp;quot; to ask you about potential fraud on your account. You just have to hang up and call them back, you can&amp;#x27;t tell the difference based on &amp;quot;reasons&amp;quot;.&lt;p&gt;It is very hard for the end-user to tell what 2FA request is &amp;quot;for no reason&amp;quot;. I think we need to focus not on what the &amp;quot;reason&amp;quot; is or if it&amp;#x27;s &amp;quot;out of the blue&amp;quot;, but, the equivalent of &amp;quot;call them back&amp;quot; for online too -- don&amp;#x27;t click on a link in an email, etc.&lt;p&gt;No matter what, it&amp;#x27;s not easy, especially for less technical users. The linked account is a &lt;i&gt;security professional&lt;/i&gt; that fell for it -- I personally don&amp;#x27;t have the hubris to think I never would.&lt;p&gt;There have been times when an actual bank asks me to do something I &lt;i&gt;know&lt;/i&gt; is insecure, and I consider resisting it, but I just didn&amp;#x27;t have the energy for it, I figured it really was the real bank just being idiotic and I wanted to get on with my day (and guess what, it was, I was right).&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;krebsonsecurity.com&amp;#x2F;2020&amp;#x2F;04&amp;#x2F;when-in-doubt-hang-up-look-up-call-back&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;krebsonsecurity.com&amp;#x2F;2020&amp;#x2F;04&amp;#x2F;when-in-doubt-hang-up-lo...&lt;/a&gt;</text></comment>
<story><title>The Rise of One-Time Password Interception Bots</title><url>https://krebsonsecurity.com/2021/09/the-rise-of-one-time-password-interception-bots/</url></story><parent_chain><item><author>julianlam</author><text>I disagree. TOTP-based 2FA is leaps-and-bounds more secure than SMS based 2FA and will stop nearly all attempts to access your account.&lt;p&gt;The fault here lies with victims answering a prompt to enter their 2FA out of the blue. Just as with passwords and other such info, the bank will never request it for no reason.&lt;p&gt;A hardware token using webauthn protocol is most secure though, yes.</text></item><item><author>hannob</author><text>Ultimately what this shows is that two factor authentication with either TOTP (aka Google Authenticator) or SMS is not ideal. It makes phishing harder for the attacker, but it does not prevent it.&lt;p&gt;Unfortunately he fails to mention that there is a way to do 2fa that does prevent phishing: Hardware tokens with the webauthn protocol.</text></item></parent_chain><comment><author>UncleMeat</author><text>We&amp;#x27;ve spent years and years and years trying to train people to resist phishing. It doesn&amp;#x27;t work. Even actual literal security professionals fall for it. If you use a thing with such common known failure modes, it is your responsibility for using that thing.&lt;p&gt;Phishing is enormously more common than sim-swapping because, as described in TFA, it can be fully automated. Going from SMS to TOTP fixes a rare attack but does not fix a common attack.</text></comment>