Skip to main content

Warning: Hackers could take over your email account by stealing cookies, even if you have multi-factor authentication (MFA)

 



Posted: November 5, 2024 by Pieter Arntz

The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication (MFA) a user has set up.

Here’s how it works.

Most of us don’t think twice about checking the “Remember me” box when we log in. When you log in and the server has verified your authentication—straight away or after using MFA–the server creates a session and generates a unique session ID. This session ID is stored in a session cookie (or a “Remember-Me cookie” as the FBI calls it) on your browser, which is typically valid for 30 days.

Every time you return to that website within the time frame, you don’t need to log in. That’s really convenient… unless someone manages to steal that cookie from your system.

If someone steals the session cookie, they can log in as you—even if you have MFA enabled.

This is particularly relevant for email handlers that have an online—webmail—component. This includes major players like Gmail, Outlook, Yahoo, and AOL.

With access to your email account, a cybercriminal can find a lot of useful information about you, such as where you bank, your account numbers, your favorite shops, and more. This information could then be used for targeted cyberattacks that only mention information relevant to you, leaving you more likely to fall for them.

Cybercriminals could use your account to spread spam and phishing emails to your contacts. And perhaps most worrying of all, once an attacker is in your email account they can reset your passwords to your other accounts and login as you there too.

How do these criminals get their hands on your session cookies? There are several ways.

On very rare occasions, session cookies can be stolen by you visiting a malicious website, or via a Machine-in-the-Middle (MitM) attack where a cybercriminal can intercept traffic and steal cookies if they’re not protected by HTTPS on an unsecured network.

However, session cookies are usually stolen by malware on the your device. Modern information-stealing malware is capable of, and even focuses on, stealing session cookies as part of its activity.  

How to keep your email account safe

There are a few things you can do to stay safe from the cookie thieves:

  • Use security software on every device you use.
  • Keep your devices and the software on them up to date, so there aren’t any known vulnerabilities on them.
  • Decide whether you think it’s worth using the Remember me option. Is convenience worth the risk in this situation?
  • Delete cookies, or—even better—log out when you are done. That should also remove or invalidate the session ID from the server, so nobody can use it to log in, even if they have the session cookie.
  • Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission.
  • For important accounts regularly check the log in history where you can see which devices logged in when and from where. You should be able to find this option in your account settings.

Comments

Post a Comment

Please no profanity or political comments.

Popular posts from this blog

NCOFCU - "Video Mini's" The Federal Reserve

The Federal Reserve, often referred to as the Fed, is the central banking system of the United States. Established in 1913 by the Federal Reserve Act, the Federal Reserve serves several crucial functions in the U.S. economy. Here are the main aspects of the Federal Reserve:  Visit NCOFCU's YouTube channel for more. "Video Mini's" The NCOFCU "Video Minis" are a series of concise 2-3 minute video presentations designed to deliver valuable insights and knowledge on key topics relevant to credit unions. Each video focuses on a specific subject, providing viewers with essential information in a brief and engaging format. These mini-presentations cover a range of subjects. Perfect for busy professionals seeking quick yet impactful content, the Video Minis make it easy to stay informed and enhance your credit union's operations and member services. Join us in exploring these informative and dynamic learning opportunities!
Post a Comment
Read Complete Article HERE>»

Credit Unions Must Focus On Treasury Rates to Avoid Liquidity Crunch In 2025

By Ray Birch LAKE FOREST, Ill.—Credit unions seeking to avoid a liquidity crunch this year must pay attention to one key fact: deposit rates are now a function of Treasury rates. To protect and gain deposits, CUs must price deposit services with high rates to match government rates, explained Michael Moebs, economist and chair of Moebs $ervices (see graph showing average T-bond rates are all over 4%.) “The U.S Treasury is a competitor you can no longer avoid,” Moebs said. “Rates for transaction accounts, like interest checking and savings, need to be markedly higher for 20% of consumers who hold 80% of the balances for these services.” In March 2023, the Federal Reserve, not the FDIC, bailed out Silicon Valley Bank, guaranteeing all deposits with 90% exceeding the maximum FDIC insurance limits, Moebs pointed out. “Deposit insurance established in June 1933 was forever transformed. Sure, deposit insurance still exists, but is viewed by consumers and small businesses to have a new partne...
Post a Comment
Read Complete Article HERE>»

President Trump is leading the way toward reduced check usage by phasing out paper checks for government payments.

WASHINGTON—A new  executive order  from President Donald Trump bans paper checks as a form of payment for the federal government. The order was signed noting that Treasury checks are often reported stolen, and face other issues. The order also notes that payments made  to  the federal government are also modernizing. “Check fraud is a perennial concern for the banking industry, growing in recent years – reports doubled from 2021 to 2022. Target stores announced last year that they would stop accepting paper checks,” the Independent Community Bankers of America pointed out. “It's a great sign that the government is leading the way toward reduced check usage by phasing out paper checks for government payments,” said ICBA payments expert Scott Anchin, noting that consumers and financial institutions should maintain the ability to determine appropriate payment mechanisms for specific cases.  ABA President and CEO Rob Nichols said his organization welcomes President ...
Post a Comment
Read Complete Article HERE>»

5 ways credit unions can future-proof their technology for long-term success

Technology is evolving at lightning speed. If credit unions want to stay relevant and serve their members like rockstars, it’s time to think ahead. While this may sound daunting, it’s actually a thrilling time to be in the financial services business—especially as a credit union. By diving into cloud-based banking, embracing AI to handle manual, repetitive tasks, and doubling down on data security, credit unions can improve their members’ lives, and set themselves up for long-term success. Below are five ways credit unions stay ahead of the competition, no matter what comes next. 1. Embracing cloud-based banking When it comes to the future, transitioning to a cloud-based banking platform is one of the most significant steps a credit union can take, especially in terms of scalability and flexibility. Cloud platforms provide the infrastructure necessary for credit unions to efficiently manage operations, reduce IT costs, and respond quickly to market changes. As if all that wasn’t enough...
Post a Comment
Read Complete Article HERE>»

Will Fed be Watching ‘That ’70s Show,’ Economy Version? Debate is On

WASHINGTON–When the Fed opted not to raise rates last his week after expressing concerns over lingering inflation—while also stating it sees strength in the economy—there is another word it “dreads” but also didn’t mention, according to a new report. That word? Stagflation, an “an economic curse that is hard to escape.” Stagflation is the term used for a combination of high inflation, stagnant economic growth, and high unemployment. “Eager to soothe worried investors, businesses and consumers, the Fed urged caution about getting too worked up about its forecast, noting that inflation caused by tariffs may not be long lasting,” said CNN in an analysis released after the Fed adjourned this week. “Nevertheless, there’s no cocktail a central banker hates more than high unemployment mixed with high inflation.” Wall Street Gets Jitters The report noted that Wall Street has already begun to sound the alarm about stagflation, Fed Chair Jerome Powell has remained relatively “sanguine.”  “Bu...
Post a Comment
Read Complete Article HERE>»