How to Counter MFA Bypass and Proxy Attacks

TL;DR

Multi-factor authentication can be bypassed when an attacker places a reverse proxy between a victim and the legitimate website, captures session cookies, and transfers them to a browser instance. Users should verify domains carefully, while organizations can consider U2F with registered hardware keys and asymmetric cryptography to make origin verification harder to defeat.

Transcript

Hello. Good afternoon. Welcome, welcome. Um, it's fantastic to be here today. Uh, welcome to the SANS panel discussion. Now, this is the first time we've done this at RSA in APJ, so we are really, really pleased to be here with you today. My name's Nick Klein. I am a SANS instructor, and I'm based out of Sydney. And, uh, I always love coming up to ... Read More

Key Insights

• Multi-factor authentication is not a complete defense when attackers can position themselves between a victim and the intended website. SMS codes and mobile approval prompts may confirm possession of a device, yet a reverse proxy can relay the authentication process and capture the authenticated session.
• A reverse proxy can be invisible to the connecting user because it accepts the user's request and communicates with the real service on the user's behalf. In the described attack, this position allows the attacker to decrypt incoming traffic and relay requests to the legitimate website.
• A convincing phishing domain can differ from the legitimate domain by a small detail. The example contrasts foobank.co with foobank.com, showing how an attacker can use a valid wildcard SSL certificate and an HTTPS connection to make the fraudulent destination appear trustworthy.
• HTTPS does not prove that a user has reached the intended organization. In the scenario, the victim establishes an encrypted connection directly with the attacker's domain, which has a valid certificate, allowing the attacker to decrypt the traffic before creating a separate connection to the real service.
• Murina and NecroBrowser support a proxy-based authentication attack. Murina facilitates the reverse-proxy portion, while NecroBrowser receives captured cookies in Dockerized, headless Chrome browser instances that can connect to the legitimate service while impersonating the authenticated victim.
• Session cookies are valuable because they represent the authenticated session created after the victim completes the login process. Once the attacker obtains those cookies through the proxy, they can be passed to NecroBrowser and used to conduct sensitive transactions as the victim.
• U2F uses registered hardware keys and asymmetric key cryptography to strengthen authentication. The user plugs a YubiKey into a device and registers it with supporting organizations or websites, creating an origin-related cryptographic check that a man-in-the-middle attacker cannot readily satisfy.
• No defensive measure provides a perfect solution to every authentication problem. The panel presents U2F as a relevant countermeasure for the demonstrated proxy attack, while the phishing example also shows why users must inspect destination domains instead of treating a valid certificate as sufficient proof.

Questions & Answers

Q: How can attackers bypass multi-factor authentication?

Attackers can bypass multi-factor authentication by placing a reverse proxy between a victim and the legitimate website. A phishing message directs the victim to an attacker-controlled domain that resembles the real one. The proxy relays the login, password, and second-factor interaction to the legitimate service, then captures the cookies associated with the completed authenticated session.

Q: Why can SMS authentication codes provide false confidence?

SMS codes confirm that the person completing the login has access to the device receiving the code, but they do not necessarily prove that the person is communicating directly with the intended website. If an attacker controls a reverse proxy, the victim can enter the code into the fraudulent site while the attacker relays it to the real service.

Q: What role does phishing play in a reverse-proxy attack?

Phishing supplies the initial path to the attacker-controlled proxy. The example message claims that the recipient's account has been compromised and asks the recipient to log in to validate transactions. Its link leads to a similar-looking domain, such as foobank.co instead of foobank.com, where the attacker can proxy the entire authentication exchange.

Q: Why does HTTPS not stop the described phishing attack?

HTTPS protects the connection to the domain that the user actually visits, but that domain may belong to the attacker. In the example, the attacker obtains a valid wildcard SSL certificate for the similar-looking domain. The victim therefore creates an encrypted tunnel to the attacker, who can decrypt that traffic and separately communicate with the legitimate website.

Q: What is the difference between a forward proxy and a reverse proxy?

A forward proxy acts on behalf of a user seeking resources elsewhere, such as an employee connecting from a workplace network to the Internet without a public IP address. A reverse proxy sits in front of services and may be hidden from users, commonly distributing requests among background servers. The demonstrated attack repurposes the reverse-proxy model maliciously.

Q: How do Murina and NecroBrowser work together?

Murina and NecroBrowser are presented as components of the authentication-bypass technique. The reverse proxy accepts the victim's connection and fulfills requests against the legitimate website. It captures cookies associated with the resulting session, then passes them to NecroBrowser. NecroBrowser uses Dockerized, headless Chrome instances to connect as though each instance were the authenticated victim.

Q: Why are captured session cookies dangerous?

Captured session cookies can allow an attacker to reuse the authenticated state established by the victim. In the described attack, the victim supplies the password and completes the second factor through the proxy. The attacker then transfers the resulting cookies to a headless Chrome browser instance, which can impersonate the victim and perform sensitive transactions.

Q: How can U2F help counter man-in-the-middle attacks?

U2F uses a registered hardware device, such as a YubiKey, together with asymmetric key cryptography. The user plugs the key into a device and registers it with websites or organizations that support the technology. Because the cryptographic process incorporates origin verification, an attacker positioned in the middle cannot readily decrypt the exchange or prove the required origin.

Summary & Key Takeaways

• The panel brings together SANS instructors with experience in vulnerability research, exploit development, incident response, threat hunting, cybersecurity management, and industrial control system security. Their discussion focuses on attack methods encountered through practical work, how those methods operate, and defensive measures that organizations can consider when preparing their security programs.

• Stephen Sims describes why SMS codes and mobile approval applications can create a false sense of security. If attackers persuade a victim to connect to a similar-looking domain under their control, a reverse proxy can relay authentication traffic to the legitimate service while observing credentials, cookies, and the resulting authenticated session.

• The demonstrated approach combines the Murina reverse-proxy tool with NecroBrowser, which uses Dockerized, headless Chrome browser instances. After collecting session cookies through the proxy, attackers can transfer them to a browser instance, impersonate the victim, and perform sensitive transactions. U2F hardware keys are presented as a relevant defensive measure.