Phishing is everywhere nowdays and the Internet is more dangerous now than ever before. All this possible due to the increased dynamic content and more integration with other technologies, like ActiveX. One of the new defenses against phishing attacks is multi-factor authentication schemes. In this scheme, users are authenticated to a service by more than just a username/password combination. Generally, this uses another authentication proof (what you have, what you know, and what you are). While this is a new technology, company’s such as Citibank have been implementing this to maintain a competitive edge and secure their customers’ data. Well, now it appears that said solution from Citibank has been circumvented. The Washington Post is carrying details on how a WebSite used a “man-in-the-middle” attack and some very cleverly designed emails and website to lure unsuspecting users in. A few interesting points here… First, the email calls out an IP Address of the “hacker that tried to access the account”. Once a users bites, they are taken to a web page that appears to be in the citibank namespace, but upon closer inspection is actually on a russian (.RU) site. When the user enters their credentials and the one-time pin from the token, these are passed to a PHP page which logs into CitiBank as that user. Then a money transfer is quickly performed while the pin is still valid (lifetime of 1 min). Even better, if you present bad credentials, you will see an error on the phishing page. This is a very convincing phishing scheme that many would fall into. This is just further proof that we all need to be on our toes when surfing online.
Technorati Tags: CitiBank, Phishing, Man-in-the-middle, privacy, two-factor authentication