But of course you are thinking to yourself "But Mark, in order for that to work the victim would need to accept a counterfeit SSL certificate before any of the traffic could be decrypted! Of course nobody is going to accept your fake certificate!". This has lead me to believe that some of you would think that the following is a true story:
A guy was driving to a really important meeting (the kind of meeting that would literally change his life for the better) but he noticed a sign on the only road that led to the meeting saying "You probably should not go down this road because someone could be trying to take advantage of you in uncommon and unlikely ways". So he didn't. And he missed his meeting. He won at life.
Now admit that the above scenario would never actually happen as we are brave, curious, and sometimes an incurably idiotic species and consider the true outcome of the story above where he says
"Screw it - I've seen this sign in the past and nothing bad has happened to me. I'm going to this meeting." and drove to the meeting without a care in the world.
The same is true when presenting a victim with a fake SSL certificate. MOST ARE GOING TO ACCEPT IT, whether your choose to believe it or not. In fact, we have calculated a 90% acceptance rate of SILICA's fake SSL certificates (that are generated on-the-fly to appear as legitimate as possible) coming from the domains that are being impersonated.
The truth is that passwords just completely flood into SILICA now from all targeted protocols as if it's a new popular trend. In fact it's borderline ridiculous. Phones are the worst. Like a well-trained dog your phone is eager to log in and fetch your daily life and place it at your feet. This is good for convenience but bad for security. As soon as an attacker becomes the access point to which your phone automatically connects the attacker almost immediately harvests web site passwords, social networking application passwords and email service passwords. The following is a screenshot of SILICA stealing passwords (out from under SSL-enabled protocols).
 |
| Facebook, Twitter, Hotmail and Gmail account passwords intercepted in SSL traffic during a controlled phishing attacked using SILICA. |
Here is a practical example of an attack - you open your iPad and you want to check your Gmail account. So you open your email client like normal but this time you are presented with a popup message that looks like this:
 |
| 90% of people will click "Continue" to get what they came for and give SILICA the passwords. |
If you click "Continue" (which 90% of you will) then SILICA gets the username and password of your Gmail account. This is why it doesn't matter if someone clicks "Cancel" - because 90% of the victims have already given up the goods.
SILICA, Two-factor Authentication and Twitter Account Takeover
Phishing is a very effective method of stealing passwords as humans are typically the easiest service to enumerate them from. I wrote a small extension to SILICA's phishing engine that demonstrates how to successfully take over a Twitter account even when two-factor authentication is enabled. Hopefully this will help remove the false sense of security from your minds this is the magic solution to prevent account takeovers.
The victim user in this case will log into Twitter as normal, receive an SMS on the phone associated with the account with the legitimate token and unknowingly give them both to SILICA that will be displayed in the interface like so:
 |
| Using SILICA to successfully phish for a legitimate Twitter two-factor authentication token. |
It's that easy. Two-factor authentication just adds one more step to the entire phishing process. Keep in mind that two-factor authentication is only meant to mitigate authentication attacks where the attacker has access to the password but not the token - it does nothing to protect the session after successful authentication has already taken place. The new features of SILICA have the capability of taking advantage of both of these scenarios (as an example). If it can work on Twitter then it can work on the applications that you encounter during your penetration tests.
Also keep in mind that two-factor authentication will not prevent attackers from taking over your account if they are already on your machine, in your browser or on your network.
Conclusion
In reality the Internet does not run on protocols that were built with security in mind. Security is usually an afterthought after someone takes advantage and a band-aid is needed. The protocols that you use to get your web traffic and mail are no different.
And what's worse - the protocols that attempt to secure you are still at your mercy - you are given the choice to [sometimes unknowingly] disable all security mechanisms with an innocent looking popup message that just asks you to "Continue" or with an annoying browser warning that says "blah blah maybe you shouldn't click ok blah blah blah NOW CLICK OK TO GET WHAT YOU CAME FOR".
Author
Mark Wuergler
You can bother him here: @MarkWuergler
No comments:
Post a Comment