Passkey Phishing Attack Is Good News - DTNSB 5064  ## Metadata - Author: [[Daily Tech News Show]] - Full Title: Passkey Phishing Attack Is Good News - DTNSB 5064 - Category: #podcasts - URL: https://share.snipd.com/episode/4fcb554c-1a89-45a9-9ee0-cccfe1ad2d30 ## Document Notes ## Highlights - **Passkey Phishing Attack Explained** - Passkey security remains uncompromised, but phishing attacks exploit cross-device authentication via QR codes. - Avoid scanning unexpected QR codes during login to prevent attackers from gaining access. Transcript: Tom Merritt Story. So, you may hear about a vulnerability in passkeys out there. It's a real story, but you know, depending on who's reporting it, they might play up certain parts of it. So we thought we'd start off by explaining what's going on, both the good and the bad. And the good news is this is not a vulnerability in passkeys itself. Pass key security has not been compromised. The bad news is that some clever actors have figured out a way to trick you into authorizing an account using your pass keys. So it's a phishing attack. We'll explain. Security company Expel observed the attack from threat actors. These are threat actors. Sometimes you might see them referred to as poison seed. So it's actively being exploited the group is using the cross device authentication feature to phish people pass keys are encrypted and stored on your device they're behind biometric Protection they are phishing resistant however to let you use a passkey stored on one device to log into another device, say you've got the passkey on your phone, but you want to log into Your computer, a service provider can offer a couple of different ways. Now, the more secure way would be to do it by Bluetooth. And then Bluetooth sends the signal over Bluetooth directly from device to device with the passkey you're logging in being able to log you in on the other device and though that would Never leave your device so that would not be useful to the fisher the other method and the more common method is a qr code that you scan with one device in order to send the signal that hey Yes that device is allowed to sign on with the pass key that's on this device. And that's the method that Poison Seed is exploiting. So in order to exploit this, the attacker first has to get you to a fake site that looks like a legitimate login site. Maybe they're mimicking your corporate login site. Maybe it's a Microsoft 365 site, something like that. So if you avoid clicking on a fake link, you will not fall for this attack. But you know what? We're all human. We all click on links we shouldn't sometimes. So that's the vector for the attack. You, if you don't know this is a fake site, enter your login ID like normal. And then the fake site uses that to start the login process on the legitimate site. You don't see that, but it's doing that in the background. It asks the legitimate site to use the cross-device authentication, and then the legit site will provide it with a QR code, which the attacking site takes and displays to you, the end User. If you scan that QR code and authorize the login on your device, the attacker gets authorization to log in because it's the one that actually asked for that QR code. So what do we do about this? Well, on the side of the sites providing the login, Expel recommends the following, limit geographic locations of logins and create a system for travelers to be able to log in. That way, if the attacker is in, I don't know, Dubai, and you're in San Francisco, it can go, wait a minute, why is this login that usually comes from San Francisco coming from Dubai? And if you travel to Dubai, you can say, hey, I'm traveling to Dubai to your corporate site, whatever. You can also routinely check on common security key brands and locations in case they were able to mimic you somehow. And then, of course, the obvious one would be limit cross-device logins to Bluetooth authentication. You as a user just need to follow the normal advice about clicking links for logging in, checking the URLs are legitimate. And also, if you're not expecting cross-device login, like if you're not logging in on a computer and you know the passkey's on your phone, if you know the passkey's on your computer ([Time 0:03:00](https://share.snipd.com/snip/d94baf01-2b38-4493-957e-ac06e2205894)) - **Avoid Phishing by Skipping Links** - Avoid clicking login links in emails; always navigate to login pages directly or via trusted bookmarks. - If you get an unexpected QR code for cross-device login, be suspicious and do not authorize it. Transcript: Tom Merritt And you get a QR code, well, then be suspicious. Something's up. Rob, you got any other thoughts on this? Robb Dunewood Yeah, it's a bummer. I mean, have we thought about just telling threat actors, just stop it, just stop doing this to make it easier on us? Can you just cut it out, please? Enough is enough. Just cut it out. But here's the thing. We really have to start thinking about accessing links to get to a log on site in the same way that we would have a bank call us and then ask us for information. If a bank ever calls you, they know who you are. They don't need your login. They don't need your password. They don't need any of this. You don't even want, you know, and sometimes with the, you know, if it's a malicious person, they always say, well, we'll just call us back at this number and you can verify that way you're Calling us. You don't even want to do that because they gave you the number. We have to kind of think about all links this way. We should just never, ever click on something that takes us to a place where we're logging into something that we care about. That just has to get socialized out there because as you said that will absolutely shut this down it takes this man in the middle attack essentially to make this happen you've got to go To a fake site for this to work if you never go to the fake site you are ultimately going to be relatively safe from this yeah and and then you know like like we said if you uh never useice login, Tom Merritt Then you wouldn't be victim to this because if it presented you with one, you're like, I don't do that. Maybe you keep your pass keys in a vault, like 1Password or something like that. But then, of course, that limits the flexibility of this. Again, you have to rely on your site to support the Bluetooth method, but you can choose to use that all the time if that's available to you. I'm with you, though. It is disappointing that we have gotten to the point where it's like, oh, man, even passkey, we can't just not think about yet. Password multi-factor authentication method that the passkey is meant to replace is rife with multiple like hundreds of versions of this that are easier to implement for the attacker So this this is a more difficult and a more narrow one so passkeys have made an advance and and they are better than having a password because the password's stored on a remote server that They can access uh and it's easier to phish you because you don't have to go through all of the jumping through hoops to show a QR code and trick you into putting that. If you go to the login site that's fake and you put in your login and your password and your multi-factor authentication, you've been phished. You've been hacked at that point. So it's much easier to do this with passwords. I guess it shows how popular passkeys are that threat actors are like, well, we got to figure out a way to get at people who use passkeys now. Robb Dunewood As long as it's beneficial to them to get into stuff, they're going to figure out a way. And this is one of those ones where passkeys are still infinitely more secure than passwords. We just have to be careful. Don't click a link to go to your logon page. Just go, just know your logon page, have a bookmark on your device that'll take you to it that was given to you by, you know, by your organization. Don't just click on an email link or anything like that. That'll take you to a logon page and then log in because that's ultimately where we will run into problems with this. Tom Merritt And listen, if you're like, oh, I've done that before, forgive yourself. None of us are perfect. We all have those moments, but you know, do what you can to remind yourself and limit that as close to zero as possible. And that's going to help. Robb Dunewood One of the things that a lot of companies already have in place, and it was illustrated here in this article, is that the company that you're trying to log into, if they don't recognize The IP address that you're coming from, it looks like this is not a regular thing. They'll just stop you. They might make you jump through an additional hoop, but how often are you in Dubai logging in? If that's like a once every four or five year thing, then jump through the hoop. So I think that that will help a lot of organizations with this by just, if you don't recognize the IP address, make them do some additional things to check just to get around this. But at the end of the day, just don't click on links to go to log on pages. Do your best. DTNS ([Time 0:06:45](https://share.snipd.com/snip/8309c3d9-da9b-469d-9a0e-8eea3e47c268)) - **Patch SharePoint Vulnerabilities** - If using Microsoft SharePoint on-premises or in private cloud VMs, promptly apply security patches for code execution and spoofing vulnerabilities. - Enable and configure anti-malware scan interfaces (AMSI) to enhance protection. Transcript: Tom Merritt Lets an attacker perform spoofing over the network. You don't want either one of those things. Microsoft has issued patches for the vulnerabilities for users of SharePoint subscription edition and SharePoint 2019, and a patch for SharePoint 2016 is in the works. Microsoft also recommends that customers turn on and configure anti-malware scan interface or AMSI. Robb Dunewood So I want to be very clear here because a lot of times people hear on-prem and they think, oh, that means we're running it in our own data center somewhere, maybe in our building. On-prem here also means if you're running it in a VM. So if you're not running this in Microsoft 365 Cloud, if you're running this in Amazon, if you're running this on Google, even if you're running this in your own tenant on Azure and it's Not managed by Microsoft, that is still considered on-prem. So you want to be careful with that. This includes VMs as well. That's ([Time 0:16:16](https://share.snipd.com/snip/21902fc1-7565-4da2-865e-2a94f055a2e7)) - **Beware Inflated EV Sales Claims** - Chinese EV makers inflated sales by insuring cars before sale to count them as sold. - Consumers should be cautious interpreting sales numbers amid such manipulations. Transcript: Robb Dunewood Indicating that Chinese EV makers Neta and Zeker inflated sales in recent years. The companies issued cars before they were sold, which let them report them as sales under Chinese regulations. Neta did this for 64,719 of its 117,000 reported sales between January 2023 and March 2024. Chinese state media also reported this story and indicated that the government is investigating the companies and called for the practice to end. This is not great news for the EV industry as a whole, as Wired has a story about several EV models being canceled Honda, Nissan, Ford, and others. Tom Merritt Yeah, yeah. A couple of stories here, you know, not great for the EV market, but this insured story in particular, Netta and Zika are not disobeying the law. There are two different numbers they report. There's a wholesale number and there's a retail number. And if they insure a car, they're actually, I think, required to report that as a sale. However, what it looks like is that Netta was insuring every car it could so it could report it as a sale. Zeeker is trying to say they were just insuring cars that were display models in showrooms and therefore had to report them as sales, but they weren't trying to juice the numbers. And maybe that's true. Maybe it's not. Zeker's numbers were not nearly as inflated as Netta's were. Robb Dunewood I mean, 64,719 to 117,000. I'm not a massive vaunt, but I'm pretty sure that's like half. Yeah. So, you know, over half. I don't know. Maybe this falls into the alternative accounting practice. Tom Merritt Yeah. No, Netta was clearly manipulating this. Maybe Zeker wasn't, but Netta was. In fact, there were some stories in this Reuters report that customers were being told that they had insurance on their car when they bought it and were kind of surprised like, oh, okay. But then the insurance would expire like after a month because they had insured the car long before it went on sale. So yeah. Robb Dunewood It seems like they would know if you only do that month-to insurance, that's really expensive. Tom Merritt Yeah. Robb Dunewood For the car company. I don't think that was the number that they were trying to be concerned with, though. ([Time 0:23:07](https://share.snipd.com/snip/00e2ac74-081a-4d2e-ad6c-7ba0f0662add)) - **University AI Misuse Challenges** - University faces academic misconduct issues with student misuse of AI, like generating study guides that contain errors. - Faculty sometimes rely on unreliable AI plagiarism checkers causing further challenges. Transcript: Tom Merritt Yeah, they wrote, I currently work in the area of student conduct at a major university, so I have a more boots on the ground view of the current situation. Our office partners with faculty to investigate and adjudicate allegations of all forms of academic misconduct, including misuse of generative AI. We are seeing students using AI in ways we have not prepared for and that we cannot fully address via written policies. One newer example is students feeding course materials into ChatGPT or Gemini and prompting it to make a study guide. They say the study guide is more manageable than 15 weeks worth of slides, syllabi, lecture notes, and so on. The problem there is that the model sometimes spits out incorrect summaries or information and the student is not able to recognize when that occurs, resulting in some very odd answers That they are unable to explain on exams. An example on the faculty side of things would be faculty sometimes upload student documents to AI checkers, which are notoriously unreliable, then file a report with our office based On those outcomes. In both of these cases, individuals are uploading academic works that are not their own into LLMs or other databases, which creates an additional layer of concern beyond the possible Misuse in general. Robb Dunewood I feel for educational systems over this type of stuff because AI is coming so fast. And in one of these cases here, I'm thinking it would be really cool to just load up your syllabi into like notebook LM to make a study guide. You're not trying to cheat. You're just trying to study more effectively with what was given to you. And that's still problematic. And then, of course, I would not want to be on the end of being told that something that I actually wrote myself indeed looked like AI because AI said it looked like AI. Yeah, no, we know we can't trust AI. So. So, yeah, I really do feel for for the educational system from, you know, from the lowest levels to the highest levels, because this stuff is coming faster than they can adapt to it. Yeah. Tom Merritt And they will adapt, but it's going to be overwhelming, like our loyal patron here is saying for a long time. And you can look at any one of these given examples and say like, oh, well, one solution could be the professor should do the summary and make sure it's correct. And then that way the students get a summary. And maybe that's a great idea. Maybe some professors will do that. But that solves one example, right? There's all kinds of other examples that were not cited here. It's that there's tons of unanticipated uses here. And until this all shakes out and until LLMs hit that, that top of the hype curve, you know, where, where we kind of just know what they're good for. We're going to keep having unusual uses of them. ([Time 0:28:04](https://share.snipd.com/snip/2ce7c361-6f01-437d-ba73-89e4870d873c))