Phishing tool that bypasses Gmail 2FA released on Github

The reverse proxy 'Modlishka' tool is designed to make phishing attacks as "effective as possible"

A security researcher has released a tool that can bypass a host of two-factor authentication (2FA) schemes widely used across platforms such as Gmail and Yahoo.

Polish researcher Piotr Duszyski published his tool, which uses a reverse proxy method, on GitHub alongside a step-by-step guide outlining how it can be used in a phishing scam to scalp user credentials and 2FA codes in one example against Google's security barriers.

When deployed, the tool places a server named Modlishka between a phishing target and a secure platform such as Gmail, which phishing victims unwittingly connect to in order to enter login details.

In a hypothetical phishing campaign, a targeted user would encounter a malicious email containing a link to the proxy server mimicking a Google login procedure. The user would then enter their user name and password, and then the 2FA code (received for instance via text message), all of which would be collected and held on the proxy server.

Advertisement
Advertisement - Article continues below

To make a success of the attack, a malicious actor would be required to monitor this process in real-time, and enter the 2FA code before it expires to gain entry.

Due to its simplicity, an attacker hypothetically using Modlishka to orchestrate a phishing campaign wouldn't need to recreate any websites themselves as is commonly done. All that's required is a phishing domain and a valid TLS certificate.

"So the question arises, is 2FA broken?" Duszyski said. "Not at all, but with a right reverse proxy targeting your domain over an encrypted, browser trusted, communication channel one can really have serious difficulties in noticing that something is seriously wrong.

"Add to the equation different browser bugs, that allow URL bar spoofing, and the issue might be even bigger. Include lack of user awareness, and it literally means giving away your most valuable assets to your adversaries on a silver plate."

Duszyski has already successfully tested his tool on platforms such as Gmail and Yahoo.

The tool, which he says is for penetration testing and educational purposes only, casts doubt on 2FA as an effective layer of protection against intruders and malicious actors. Modlishka can, in particular, be used to make phishing campaigns "as effective as possible".

The only way to resolve this issue from a technical perspective, he added, was to rely on hardware tokens based on the universal 2nd-factor protocol (U2F); that is hardware devices built specifically to serve as authentication modules that do not require users to enter codes manually.

The fallibility of common 2FA routines has been exposed in recent months, particularly via a massive data breach that social news aggregator Reddit sustained last year as a result of weaknesses in its security.

After intercepting a handful of its employees' SMS-based 2FA setup and gaining access to their accounts, a malicious actor made away with a trove of user credentials, including email addresses.

Reddit's CTO Chris Slowe said following the incident that the company realised text message-based 2FA is "not nearly as secure as we would hope" and recommended that everybody moved to token-based 2FA.

Advertisement
Advertisement - Article continues below

Meanwhile, a strain of malware uncovered last year, known as Roaming Mantis, was reported to base Android-oriented attacks on a mechanism that cracks 2FA and hijacks users' Google accounts.

Security expert Graham Cluley told IT Pro the tool could work in practice, but that users can protect themselves against a Modlishka-centric phishing campaign by using hardware-based 2FA, or a password manager. 

"Reading about Modlishka it sounds like it would work, proxying the content of the genuine site to make a phishing site very believable and intercepting any information entered, such as passwords and 2FA codes," he said.

"2FA codes tend to be time-restricted, often changing every 30 seconds. As such, an attacker may have to be monitoring the phish in real-time to maximise the account access.

"So, it's an impressive demonstration - but users should continue to use password managers, unique passwords, and enable 2FA wherever possible."

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019
Visit/business/business-strategy/354252/huawei-takes-the-us-trade-sanctions-into-its-own-hands
Business strategy

Huawei takes the US trade sanctions into its own hands

3 Dec 2019
Visit/mobile/mobile-phones/354273/pablo-escobars-brother-launches-budget-foldable-phone
Mobile Phones

Pablo Escobar's brother launches budget foldable phone

4 Dec 2019