TechNews

Sophos Show How Attackers Exploit Stolen Session Cookies to Bypass Multi Factor Authentication

With Stolen Session Cookies, Attackers can Impersonate Legitimate Users and Move Freely Around the Network, says Sophos

Published

2 years ago

August 18, 2022

grassroots

Sophos, a global leader in next-generation cybersecurity, today announced in the Sophos X-Ops report, “Cookie stealing: the new perimeter bypass,” that active adversaries are increasingly exploiting stolen session cookies to bypass Multi-Factor Authentication (MFA) and gain access to corporate resources.

Key points:

Sophos is seeing a growing number of attackers—including active adversaries—using stolen session, or authentication, cookies to bypass MFA and access corporate resources
These stolen cookies allow attackers to impersonate legitimate users and move freely around a network. Once inside, there is really no limit to what they can do; they can tamper with cloud infrastructures, compromise business email, or even rewrite code for products
While bulk credential theft (including bulk cookie theft) is still common, Sophos is witnessing a growing number of targeted attacks to steal cookies from specific types of organizations
One common underground marketplace for these stolen cookies is Genesis
This is an important table setter piece for Sophos:
- While other companies have discussed the theoretical rise of attacks bypassing MFA or spoken about isolated incidents involving stolen session cookies, we’re talking about an overall trend and what we’ve witnessed in the field and in the data from our own telemetry
- We will be building on the cookie theft/MFA bypass angle in the coming months

In some cases, the cookie theft itself is a highly targeted attack, with adversaries scraping cookie data from compromised systems within a network and using legitimate executable to disguise the malicious activity.

Once the attackers obtain access to corporate web-based and cloud resources using the cookies, they can use them for further exploitation such as business email compromise, social engineering to gain additional system access, and even modification of data or source code repositories.

“Over the past year, we’ve seen attackers increasingly turn to cookie theft to work around the growing adoption of MFA. Attackers are turning to new and improved versions of information stealing malware like Raccoon Stealer to simplify the process of obtaining authentication cookies, also known as access tokens,” said Sean Gallagher, principal threat researcher, Sophos. “If attackers have session cookies, they can move freely around a network, impersonating legitimate users.”

Session, or authentication, cookies are a particular type of cookie stored by a web browser when a user logs into web resources. If attackers obtain them, then they can conduct a “pass-the-cookie” attack whereby they inject the access token into a new web session, tricking the browser into believing it is the authenticated user and nullifying the need for authentication.

Since a token is also created and stored on a web browser when using MFA, this same attack can be used to bypass this additional layer of authentication.

Compounding the issue is that many legitimate web-based applications have long-lasting cookies that rarely or never expire; other cookies only expire if the user specifically logs out of the service.

Thanks to the malware-as-a-service industry, it’s getting easier for entry-level attackers to get involved in credential theft. For example, all they need to do is buy a copy of an information-stealing Trojan like Raccoon Stealer to collect data like passwords and cookies in bulk and then sell them on criminal marketplaces, including Genesis.

Other criminals on the attack chain, such as ransomware operators, can then buy this data and sift through it to leverage anything they deem useful for their attacks.

Conversely, in two of the recent incidents that Sophos investigated, attackers took a more targeted approach. In one case, the attackers spent months inside a target’s network gathering cookies from the Microsoft Edge browser.

The initial compromise occurred via an exploit kit, and then the attackers used a combination of Cobalt Strike and Meterpreter activity to abuse a legitimate compiler tool to scrape access tokens. In another case, the attackers used a legitimate Microsoft Visual Studio component to drop a malicious payload that scraped cookie files for a week.

“While historically we’ve seen bulk cookie theft, attackers are now taking a targeted and precise approach to cookie stealing. Because so much of the workplace has become web-based, there really is no end to the types of malicious activity attackers can carry out with stolen session cookies. They can tamper with cloud infrastructures, compromise business email, and convince other employees to download malware or even rewrite code for products. The only limitation is their own creativity,” said Gallagher. “Complicating matters is that there is no easy fix. For example, services can shorten the lifespan of cookies, but that means users must re-authenticate more often, and, as attackers turn to legitimate applications to scrape cookies, companies need to combine malware detection with behavioral analysis.”

To learn more about session cookie theft and how adversaries are exploiting the technique to carry out malicious activity, read the full report, “Cookie Stealing: the new perimeter bypass,” on Sophos.com.

TechNews

SIM Boxing, And The Unboxing of a Crime Syndicate

Writer: Suleiman Bala Bakori

Published

2 weeks ago

May 6, 2024

grassroots

Boxes have a multitude of uses, and the word “box”, lends itself to diverse contexts. For “Ajala Travelers,” the box is a necessity for keeping goods for their endless journeys. In literature, idiomatically, it can be said that “one has been boxed into a corner;” another might say to deal with a conundrum: “think outside the box;” then there is the “Pandora’s box” that no one wants opened.

To “box one’s ear’s” refers to a hit on the head, especially around one’s ears. For those who celebrate Christmas, “Boxing Day,” which is the 26th of December, the second day of Christmastide is not to be joked with: A day to unbox gifts. So much for the box.

Another type of boxes exists in the telecommunications world: The SIM Box. Have you ever received an international call but saw a local phone number ring in? That is SIM Boxing in action. Let me explain.

SIM boxing happens when a person uses a special equipment, what is called a SIM Box containing tens to hundreds of SIM Cards—from 32, to 96, to 512 and more SIMs —to terminate international calls by bringing in the international call into the SIM Box using internet connections and regenerating the calls to the called party from one of the hundred SIMs in the box.

This way, the called party will see the local number of the SIM from the SIM Box, and not the original international number calling.

With SIM Boxes, the syndicate charges international call carriers lower rates than what regular Nigerian telecommunications operators would charge, as they do not have to pay the full cost of maintaining and operating a phone network.

Basically, they are bypassing the normal route for international phone call termination to terminate international calls cheaply and making windfall profits off it.

Take for instance, a telecommunications operator in Nigeria would ordinarily charge international carriers 10cents per minute for terminating an international call in Nigeria. However, by routing the call through a SIM Boxing syndicate, the international telecommunications carrier only pays a fraction of the charge to the syndicate, say 5cents per minute and does not have to pay the full 10cents per minute charge.

The SIM Boxer will terminate this call to the called subscriber at a rate of, say N15 per minute using one of the SIM cards in their SIM Box. The SIM Boxer thus makes a killing from the differential between the rate charged to the international carrier and the rate paid to telecommunications operators whose SIM they utilise in their SIM Boxes, at the expense of our national security and income of mobile network operators and quality of our service to consumers.

Asides the revenue loss that local mobile network operators suffer courtesy the activities of these syndicates, networks face congestion around areas where the illegal call routings via SIM Boxing occurs. With the huge traffic from the boxes, callers around the area see more dropped calls, poor call quality, and slower data speeds.

The introduction of the linking of National Identity Numbers (NIN) to SIMs is one way the Federal Government has worked to tackle this criminal enterprise. With every SIM in the country being linked to an NIN, an identity is tied to the owner of each line, and regulators now have visibility of ownership. That is not all. There is also the “Max-4 Rule” where a subscriber is not allowed to have more than four lines per network operator linked to his NIN. With this rule in place, coupled with the NIN-SIM Linkage, every telephone subscriber in Nigeria would not just be accurately identifiable but limited to having only four telephone lines per subscriber.

To enforce this rule, the Nigerian Communications Commission (NCC) on the 29th of March 2024 announced the deadline for Mobile Network Operators to bar all subscribers who had five lines and above, and whose NIN failed the verification test of biometrics matching.

Over the last few weeks, sources within the NCC have confirmed cases where a single NIN was linked to over 100,000 lines.

Some NINs had well over 10,000 SIMS linked to them, others over a thousand, others had hundreds. Many have questioned the reports and asked, what would any single reasonable person be doing with these number of lines? Justifiable questions, because no sane person—who is not running a business—should own more than five SIM cards.

Given the ‘Max 4 Rule’ in place and the NIN-SIM Linkage Policy, SIM Boxers have been boxed into a corner.

The applications they use require tens to thousands of SIM Cards, and the imperative to stay anonymous. If these policies are well and fully implemented, this is the death knell for SIM Boxing merchants.

But the regulator, NCC needs to be fast and ready for the battle ahead. SIM Boxing is a billion-dollar criminal enterprise. They are not going to go down without a fight. It is like taking a bone being chewed from the mouth of a bulldog.

Already, the battle seems to have kicked off. A lawyer, Barrister Olukoya Ogunbeje has recently taken the Federal Government, NCC and Mobile Network Operators to court, claiming that the barring of SIMs not linked to NINs goes against his fundamental human rights, and has cost him the loss of business opportunities.

Anyone who has Nigeria’s interest at heart ordinarily supports this policy. It then does not add up seeing a so-called activist lawyer take up such a matter that is clearly against the public interest—unless this is the Haka cry of SIM Boxers.

A most interesting observation with his case is that it is not even a class action, but individually driven. It begs the question then, who is funding Barr. Olukoya Ogungbeje? What is his interest in fighting this policy that puts paid to the business of a criminal enterprise? Is he funded by interests in the SIM Boxing world? Time would tell. But in the meantime, NCC must go head on without fear or intimation and clean the Augean stable of SIM ownership in Nigeria.

Suleiman Bala Bakori is a researcher, and writes from the FCT.

TechNews

inq.Digital Supports Payments Forum Nigeria [PAFON 1.0]

Published

2 months ago

March 19, 2024

grassroots

PAFON SPEAKERS

Inq. Digital Nigeria Limited has been announced as a sponsor of Payments Forum Nigeria [PAFON 1.0] maiden edition holding this Thursday in Lagos.

inq. Digital Nigeria Limited, a subsidiary of inq. Group is an emerging leading digital and cloud solutions provider that delivers simpler seamless solutions to complex business challenges.

With offices in Lagos, Abuja, Port Harcourt and Kano, inq. provides reliable and affordable Intelligent Connectivity, SDN/NFV, Cloud and Digital services (including Edge –AI) for Nigerian businesses including those in the payment space.

Participation is FREE, however, pre-registration is required: https://bit.ly/4c4N19H.

Speaking ahead of Payments Forum Nigeria [PAFON 1,0] scheduled to take place at Oriental Hotel, Lekki Road, Lagos on Thursday, March 21, 2024 by 9am under the theme: “Payments: Trust, Security and Privacy in AI Era”, Mr. Chike Onwuegbuchi, the co-founder of TechCastle Foundation, the organisers, said the goal is to enable information exchange and knowledge sharing on key industry insights issues amongst key stakeholders, with the objective of ensuring a collaborative and proactive approach to push for policies that enable growth, tackling/mitigating fraud and limiting occurrences and losses.

Speakers

The following speakers are lined up for the Forum: Chibuzo Efobi, Director, Payments System Management, Central Bank of Nigeria (CBN); Festus Amede, Chairman, Committee of Chief Information Security Officers of Nigerian Financial institutions (CCISONFI; Dr. Adewale Peter Obadare, Chief Visionary Officer (CVO), Digital Encode Limited; Adetokunbo Omotosho, Chief Executive Officer, Cybervergent; Roosevelt Elias, Founder, Payble; Ikenna Ndugbu, chief compliance officer, Moniepoint MFB, and Peter Evbota, Sales Director at inq. Digital Nigeria Limited.

Payments Forum Nigeria is organised by TechCastle Foundation and sponsored by: inq. Digital Nigeria Limited, Cybervergent, Moniepoint, Digital Encode Limited, Payble with support from the Central Bank of Nigeria (CBN).

Business

Meet Kingsley Adonu

Published

3 months ago

February 25, 2024

grassroots

In the dynamic world of entrepreneurship, there are visionaries who not only navigate the business landscape but redefine it. Meet Kingsley Adonu, the Founder and Chief Executive Officer of the SMobile Group, a conglomerate that stands as a beacon of excellence and diversity in the global business arena.

Kingsley Adonu is a visionary entrepreneur and the Founder of the SMobile Group, a conglomerate synonymous with excellence and diversity. As the Chief Executive Officer, he has steered the group to remarkable heights, overseeing a spectrum of businesses that span across Telecommunications, Oil and Gas, Real Estate, Hospitality, Water Production, Agriculture, Technology, E-commerce, Energy, Sports, Entertainment, Education, Health, Logistics and Financial Services, with branches extending globally to UK, USA, China, South Africa, and Canada.

Under Kingsley’s astute leadership, SMobile Group has emerged as a major partner for MTN, evident in the impactful presence of the SMobile brand in the telecommunications landscape. His strategic insights and forward-thinking approach have positioned the group as a dynamic player in multiple industries.

Beyond the boardroom, Kingsley Adonu is a dedicated philanthropist, committed to making a positive impact in communities. His philanthropic efforts extend beyond business, reflecting a deep-seated belief in the responsibility of successful individuals to contribute meaningfully to society.

Kingsley’s influence is not confined to national borders; he has actively participated in numerous international telecom conferences, further enriching his understanding of global industry trends and fostering valuable connections with industry leaders worldwide.

With an unwavering commitment to excellence, Kingsley Adonu continues to inspire and lead the SMobile Group towards new horizons, blending business acumen with a passion for positive societal change.