Skip to main content

Warning: Hackers could take over your email account by stealing cookies, even if you have multi-factor authentication (MFA)

 



Posted: November 5, 2024 by Pieter Arntz

The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication (MFA) a user has set up.

Here’s how it works.

Most of us don’t think twice about checking the “Remember me” box when we log in. When you log in and the server has verified your authentication—straight away or after using MFA–the server creates a session and generates a unique session ID. This session ID is stored in a session cookie (or a “Remember-Me cookie” as the FBI calls it) on your browser, which is typically valid for 30 days.

Every time you return to that website within the time frame, you don’t need to log in. That’s really convenient… unless someone manages to steal that cookie from your system.

If someone steals the session cookie, they can log in as you—even if you have MFA enabled.

This is particularly relevant for email handlers that have an online—webmail—component. This includes major players like Gmail, Outlook, Yahoo, and AOL.

With access to your email account, a cybercriminal can find a lot of useful information about you, such as where you bank, your account numbers, your favorite shops, and more. This information could then be used for targeted cyberattacks that only mention information relevant to you, leaving you more likely to fall for them.

Cybercriminals could use your account to spread spam and phishing emails to your contacts. And perhaps most worrying of all, once an attacker is in your email account they can reset your passwords to your other accounts and login as you there too.

How do these criminals get their hands on your session cookies? There are several ways.

On very rare occasions, session cookies can be stolen by you visiting a malicious website, or via a Machine-in-the-Middle (MitM) attack where a cybercriminal can intercept traffic and steal cookies if they’re not protected by HTTPS on an unsecured network.

However, session cookies are usually stolen by malware on the your device. Modern information-stealing malware is capable of, and even focuses on, stealing session cookies as part of its activity.  

How to keep your email account safe

There are a few things you can do to stay safe from the cookie thieves:

  • Use security software on every device you use.
  • Keep your devices and the software on them up to date, so there aren’t any known vulnerabilities on them.
  • Decide whether you think it’s worth using the Remember me option. Is convenience worth the risk in this situation?
  • Delete cookies, or—even better—log out when you are done. That should also remove or invalidate the session ID from the server, so nobody can use it to log in, even if they have the session cookie.
  • Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission.
  • For important accounts regularly check the log in history where you can see which devices logged in when and from where. You should be able to find this option in your account settings.

Comments

Post a Comment

Please no profanity or political comments.

Popular posts from this blog

Open Banking To Hit $94B By 2029—But U.S. Lags Amid Global Surge

Watch our Video on Understanding Open Banking NEW YORK—By 2029, open banking is projected to surge globally to a staggering $94.14 billion in value. Yet despite its rapid evolution and expanding global footprint, adoption remains uneven—hindered by inconsistent regulatory frameworks across countries. According to GlobalData, this disparity poses a key challenge for the sector’s success, with the U.S. notably trailing behind global peers in embracing open banking. The U.K. pioneered open banking and continues to be one of the leaders globally. The country has seen the number of users increasing, with there being 12.09 million active users of open banking in 2024 and 223.9 million payments made. This is an increase of 72% compared to the year before. “As open banking continues to flourish, it is positive to see that the Financial Conduct Authority (FCA) and Payment Systems Regulator (PSR) have outlined how open banking can expand further in the U.K., and also be used in variable...
Post a Comment
Read Complete Article HERE>»

Sunday Reading - What is the Declaration of Independence?

What is the Declaration of Independence ? The Declaration of Independence is the founding document that formally announced the American colonies' break from British rule. It laid the philosophical and moral foundation for American democracy, asserting that individuals possess inherent rights and that governments must be accountable to the people ( read summary here ). Although Thomas Jefferson is often remembered as the sole author ( read initial draft ), extensive collaboration shaped the Declaration. Benjamin Franklin and John Adams made small but impactful revisions— including Franklin’s reported suggestion  to change “We hold these truths to be sacred and undeniable” to “self-evident”—before submitting the draft to Congress. On July 4, 1776, the final text was adopted and sent to printer John Dunlap, who produced an estimated 200 broadsides that night—but that wasn’t the actual day of American independence . Congress had voted for independence two days earlier, ...
Post a Comment
Read Complete Article HERE>»

Why Avoiding "I" in Marketing Presentations Matters

  Grant Sheehan, CCUE | CCUP | CEO NCOFCU  You know how things just stick with you? Well, many years ago, my marketing professor started off his class with the following, and it has never left me.  The Power of Perspective: Why Avoiding "I" in Marketing Presentations Matters In the world of marketing, effective communication is paramount. One valuable piece of advice that often comes from experienced instructors and industry veterans is the importance of avoiding the use of the word “I” in presentations and reports. At first glance, this may seem counterintuitive; after all, many individuals feel that personal anecdotes and experiences can enhance a message. However, upon deeper reflection, the reasoning behind this approach reveals itself as essential for achieving impactful communication. Building Objectivity When marketing professionals present their findings or insights, it’s important to establish credibility. Utilizing data, surveys, and feedback from cu...
Post a Comment
Read Complete Article HERE>»

👨‍👩‍👧‍👦 You Need to Prepare Now to Compete for New Fed Gov’t Funded Savings Accounts for Children

WASHINGTON–Credit unions, which often talk about the need for younger members, will now have the opportunity to compete in a new arena for the youngest members of all, as the recently passed reconciliation bill includes language creating and funding for a new savings account for children, with a one-time deposit of $1,000 from the federal government for those born in 2025 through 2028. The new accounts are expected to create a new battleground of competition for credit unions as every provider from banks to fintechs to others seeks to capture the accounts.  The final version of the bill makes the tax-free savings accounts for minors, called Trump accounts, a form of individual retirement account (IRA) under Sec. 408(a), according to the Journal of Accountancy. Under the legislation, the accounts will be IRAs (but not Roth IRAs) for the exclusive benefit of individuals under 18.  About the Contributions “Contributions can only be made in calendar years before the beneficia...
Post a Comment
Read Complete Article HERE>»

Agencies Issue Exemption Order To Customer Identification Program (CIP) Requirements

WASHINGTON--The Federal Deposit Insurance Corporation, the Office of Comptroller of the Currency, and NCUA, with the concurrence of the Financial Crimes Enforcement Network, issued an order Friday granting an exemption from a requirement of the Customer Identification Program (CIP) Rule implementing Section 326 of the USA PATRIOT Act. The CIP Rule requires a bank or credit union to obtain taxpayer identification number (TIN) information from its customer before opening an account, and the exemption permits a bank or credit union to use an alternative collection method to obtain TIN information from a third-party rather than from the customer, the agencies stated in a joint release. The order applies to accounts at all entities supervised by the agencies. "Since the CIP Rule was issued initially in 2003, there has been a significant evolution in the ways consumers access financial services, along with a rise in reported customer reluctance to provide their full TIN due, in part, to...
Post a Comment
Read Complete Article HERE>»