2 Factor Proxy Bypass

 In the never ending game of cat and mouse, cyber criminals have found a way to bypass two-factor authentication. While the method is newer, the techniques and methods are not. By simply combining a normal phishing site along with a proxy, malicious actors are able to intercept two-factor auth codes and authenticated cookies.

Standard phishing emails are used, with messages asking people to update their passwords, log in to confirm an account, etc. Previously, when someone browsed to those malicious sites via the links, they would enter their account name and password. The malicious actor would harvest those credentials, and could try to use them to gain access to accounts on many sites. Two-factor authentication, when used properly, would prevent the malicious login since the attacker would never receive the authentication code. Now, with this new application of old techniques, they're able to steal not only the credentials, but also the two-factor code and even authenticated session cookies.

The proxy bypass technique would look something like this:

(image credit to Resecurity)

1. A user receives a phishing email, clicks the malicious link, and enters their credentials
2. The link sends the connection through a proxy server to the actual website (Microsoft login, Google login, etc)
3. A legitimate MFA page is proxied back to the user from the website that's being intercepted by the proxy
4. The user puts in their two-factor authentication code, which is sent via the proxy to the legitimate website. At this point, the two-factor auth code can be considered compromised
5. Website returns an authenticated session cookie to the proxy, which is relayed to the user's browser. At this point, the malicious actor has the authenticated session cookie, username, password, and two-factor code and can log in to the actual site as the victim
6. The user is redirected to another page. It's likely that the legitimate Microsoft, Google, or other site is loaded

In short, the user starts a TLS session appearing to connect to the target website. This TLS session is intercepted by the malicious proxy which can then be decrypted. The malicious proxy then creates a TLS session to the target website, and can continue to middle-man and intercept all TLS communications between the victim and the target site.

As reported by The Hacker News, PhaaS (phishing-as-a-service) toolkits utilizing this method are being sold. One example is EvilProxy, which costs as little as $400 / month.