Two-Factor Fake Attempts (T1621) v2

Written By Jeremy Pickett
“Whatever it is, the way you tell your story online can make all the difference.”
— Quote Source

Overview of T1078.004 - Two-Factor Authentication Request Generation. Two-Factor Authentication (2FA) Request Generation involves creating multiple 2FA requests to the target’s device or application. This is typically done to trick the target into approving a fraudulent authentication request or to overwhelm and disrupt legitimate authentication attempts.

These steps are a basic level of remediation for Windows, OSX, Linux, AWS, GCP, and Azure. As tool change, remediation advice changes. This entry maps to the MITRE code referenced in the entry. Please check back regularly for updates to this library entry.

Two-Factor Authentication (2FA) Request Generation: An Overview

Two-Factor Authentication (2FA) Request Generation is a sophisticated cyber attack technique that has gained prominence in recent years. This method involves creating multiple 2FA requests to a target's device or application, with two primary objectives: to trick the target into approving a fraudulent authentication request, or to overwhelm and disrupt legitimate authentication attempts. As 2FA has become a standard security measure, threat actors have adapted their strategies to exploit this additional layer of protection.

Notable Incidents and Timeline

The evolution of 2FA Request Generation attacks can be traced through several high-profile incidents. From 2018 to 2020, the Russia-based APT group APT29, also known as Cozy Bear, conducted multiple campaigns targeting government and defense sectors. Their sophisticated approach involved manipulating 2FA systems to gain unauthorized access to sensitive accounts. This group, suspected to be linked to Russian intelligence, was also implicated in the SolarWinds breach and the 2016 DNC hack, showcasing their advanced capabilities and persistent threat to national security.

In 2018, the cybersecurity community observed the widespread use of Evilginx2, a phishing toolkit designed to capture 2FA tokens by generating fraudulent requests. This open-source tool, while not inherently malicious, became a favorite among threat actors for its effectiveness in man-in-the-middle attacks against major platforms like Google and Facebook.

The following year, 2019, saw the financially motivated cybercriminal group FIN7 (also known as Carbanak) leveraging 2FA request flooding for monetary gain. Their tactics included social engineering users to approve unauthorized requests, primarily targeting banks, point-of-sale systems, and the hospitality industry.

Mid to late 2020 marked the emergence of APT35 (Phosphorous), an Iranian threat actor group, which specifically targeted activist groups by exploiting vulnerabilities in SMS-based 2FA systems. This group's activities highlight the political motivations behind some 2FA exploitation attempts, often focusing on dissidents and political adversaries.

More recently, in 2022, the Lapsus$ hacking group made headlines with their aggressive tactics targeting corporate accounts through multiple 2FA requests. Their high-profile breaches of tech giants like Microsoft, NVIDIA, and Okta demonstrated the evolving sophistication of these attacks and their potential for significant disruption.

Technical Details of Campaigns

The technical approaches used in these campaigns often start with sophisticated spear-phishing attacks. Threat actors create convincing emails or messages that lead victims to cloned web pages, often hosted by phishing kits like Evilginx2. Once credentials are obtained, the attackers use them to generate repeated 2FA requests, attempting to capture authenticator app tokens or SMS codes.

A common tactic involves flooding targets with 2FA alerts, often late at night, exploiting victim confusion or fatigue to gain approval. This social engineering aspect is crucial, as it preys on human psychology and the natural tendency to want to resolve persistent notifications.

Defensive Measures and Recommendations

To combat these evolving threats, cybersecurity experts recommend several defensive measures. Implementing hardened Multi-factor Authentication (MFA) solutions, such as physical security keys, provides a more robust defense compared to SMS or app-based 2FA. Organizations should also employ behavioral analysis and anomaly detection systems to monitor for unusual patterns, like multiple 2FA requests in short succession.

Education and awareness remain critical components of any defense strategy. Regular training sessions should inform users about the risks and signs of 2FA misuse, emphasizing the importance of vigilance even with seemingly secure authentication methods.

Review Authentication Logs:

  • Open the Event Viewer (Windows + R, type eventvwr.msc, and press Enter).

  • Navigate to Windows Logs > Security.

  • Look for Event IDs related to user logins and 2FA (e.g., Event ID 4624 for successful logons).

Implement and Enforce MFA Policies:

  • Access the Group Policy Management Console (gpmc.msc).

  • Navigate to Computer Configuration > Policies > Administrative Templates > System > Logon.

  • Enable Require Multi-Factor Authentication (MFA) for multiple identity types.

Update and Patch System:

  • Open Settings > Update & Security > Windows Update.

  • Check for updates and install any available security patches.

Review and Adjust RDP Settings:

  • Go to System Properties (sysdm.cpl) > Remote tab.

  • Ensure Allow connections only from computers running Remote Desktop with Network Level Authentication is selected.

Check Authentication Logs:

  • Open Console application.

  • Navigate to Reports > system.log and filter for authentication-related logs.

Enforce Two-Factor Authentication:

  • Open System Preferences.

  • Go to Apple ID > Password & Security.

  • Enable Two-Factor Authentication if not already enabled.

Update macOS:

  • Open System Preferences > Software Update.

  • Check for updates and install all available security updates.

Restrict Remote Access:

  • Open System Preferences > Sharing.

  • Disable any unnecessary services under the Sharing tab, particularly Remote Login.

Review Authentication Logs:

  • Open terminal.

  • Check /var/log/auth.log or /var/log/secure for authentication attempts (e.g., using grep "pam_unix" /var/log/auth.log).

Implement and Enforce MFA:

  • Install Google Authenticator or another TOTP solution (sudo apt install libpam-google-authenticator).

  • Configure PAM (/etc/pam.d/sshd) to require MFA by adding auth required pam_google_authenticator.so.

System Updates and Patching:

  • Run sudo apt update && sudo apt upgrade to apply any security patches.

Securing SSH:

  • Edit /etc/ssh/sshd_config.

  • Ensure ChallengeResponseAuthentication is set to yes.

  • Restart the SSH service with sudo systemctl restart sshd.

Review IAM and CloudTrail Logs:

  • Log in to AWS Management Console.

  • Navigate to CloudTrail > Event history and filter by eventName and eventTime.

Enforce MFA for IAM Users:

  • Access the IAM dashboard.

  • Navigate to Users, select each user, and enable MFA under Security credentials.

Patching and Updates:

  • Navigate to Systems Manager > Compliance.

  • Ensure all instances are compliant and apply patches as recommended.

Adjust IAM Policies:

  • Review and limit IAM policies to enforce the least privilege principle.

Review Logging and Monitoring:

  • Go to Logs Explorer in the Logging section of the Google Cloud Console.

  • Filter logs for authentication events and review accordingly.

Enforce MFA for Users:

  • Open Admin console (admin.google.com).

  • Go to Security > 2-Step Verification and enforce policies for all users.

System Updates and Patching:

  • Use Google Cloud Console to navigate to VM instances.

  • Ensure all instances have the latest OS patches applied.

IAM Adjustments:

  • Navigate to IAM & Admin > Roles.

  • Fine-tune roles to minimize permissions and enforce the least privilege.

Review Azure AD Sign-in Logs:

  • Access the Azure Portal.

  • Go to Azure Active Directory > Sign-ins to review authentication events.

Enforce MFA:

  • In the Azure Portal, navigate to Azure Active Directory > Security > Multi-Factor Authentication.

  • Enable MFA for users and configure policies.

System Updates:

  • Go to Azure Automation > Update management.

  • Ensure all virtual machines are up-to-date with required patches.

Security Policies and Controls:

  • Use Azure Security Center.

  • Implement security recommendations and adjust policies as suggested.

Jeremy Pickett
Previous

BITS JOBS (T1197) v2
Next

Brute Force (T1110) v2