5 ms·
Only for high value targets right? Takes some work to spoof.
by formercoder 6y ago
Only for high value targets right? Takes some work to spoof.
- strombofulous 6y agoTypically this takes enough work that it has to be at least somewhat targeted but even some rando with just a few thousand dollars in their account would probably be a large enough target because it doesn't take super long
- chimeracoder 6y agoDepending on the method, it doesn't have to be targeted to the user, just to the platform. For a platform like Robin Hood, most accounts contain enough money that even one account could pay off for the effort.
- bawolff 6y agoNo. phising sms/totp tokens works the same as normal phising. You need U2F to protect against phising. The complex attack you are probably thinking of is sim swapping which is a bit different than phising.
- formercoder 6y agoOh yeah I was thinking of sim swapping. Thanks.
- zenexer 6y agoTOTP gets a little tricky when it comes to phishing, but only because most phishing attacks that target casual users (rather than spear phishing attacks) aren't capable of logging in immediately. Naturally, that would change if enough people started using TOTP, but for now, TOTP is enough to avoid becoming low-hanging fruit. Of course, if you're a high-value target or work for a company that's likely to be targeted by spear-phishing campaigns, you should be using FIDO2. (Don't target U2F, as there are newer, backward-compatible specifications.)
- Thorrez 6y agoYeah most phishing attacks can't auto login, but there is an open source tool for doing it: https://github.com/kgretzky/evilginx2 https://github.com/kgretzky/evilginx2