Security News Hackers Find Clever Way to Bypass Google's Two-Factor Authentication

[Jack]

Content source

http://news.softpedia.com/news/hackers-find-clever-way-to-bypass-google-s-two-factor-authentication-505138.shtml

​

There's a sneaky new trick going around that can fool some people into divulging their two-factor authentication code to crooks, while thinking they're actually protecting their accounts.

Two-factor authentication, or 2FA, is a second layer of authentication that many online services support, from banks to Google, from Facebook to government agencies.

2FA works by requiring a user to enter a code that he received via SMS on his phone after he logged into a 2FA-protected account. If the user doesn't enter the code in a timely manner, the login is classified as a hacking attempt and the user blocked from accessing the account, even if he entered the correct password. You can see the benefits, right?

Crooks pass as Google, ask users for "verification code"
This past week, Alex MacCaw, co-founder of Clearbit.com, tweeted out the image of an SMS he just received.

An unknown attacker had sent MacCaw an SMS message posing to be from Google. The SMS read as follows:

“ (Google™ Notification) We recently noticed a suspicious sign-in attempt to [your email] from IP address 136.91.38.203 (Vacaville, CA). If you did not sign-in from this location and would like to lock your account temporarily, please reply to this alert with the 6-digit verification code you ill receive momentarily. If you did authorize this sign-in attempt, please ignore this alert. ”

Basically, the attackers were mentally preparing the victim to receive the 2FA verification code, for their illegal login attempt they were about to carry out.

Read more: Hackers Find Clever Way to Bypass Google's Two-Factor Authentication

 

[done]

I started to receive to my phone something similar to this. It is regarding bank account.
Reset your bank password......
Thats new trick now sending phishing links to cell phones.
Thx for sharing

 

[ForgottenSeer 19494]

There is an awesome app from Authy which you can use to be even better protected. There are more sophisticated attacks which include intercepting the SMS on its way to the phone, so with that app you can even use it offline. -> Two-Factor Authentication App • Authy

 

[DardiM]

New "protection" methods, new hacking tricks, it will never end
Thanks for sharing

 

[Lucent Warrior]

It is pretty simple really, if you did not initiate the contact from the sources contacting you, do not respond to it.

 

[AlphaBeta]

That's some clever social engineering. I know many people who would fall for this kind of phishing.

 

[DardiM]

It is pretty simple really, if you did not initiate the contact from the sources contacting you, do not respond to it.

That's some clever social engineering. I know many people who would fall for this kind of phishing.

This is so true

 

[jamescv7]

Good try but of course you cannot put down those highly experience ones.

Probably few users who do not have supervision may trick with this social engineering.