Skip to main content

Warning: Hackers could take over your email account by stealing cookies, even if you have multi-factor authentication (MFA)

 



Posted: November 5, 2024 by Pieter Arntz

The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication (MFA) a user has set up.

Here’s how it works.

Most of us don’t think twice about checking the “Remember me” box when we log in. When you log in and the server has verified your authentication—straight away or after using MFA–the server creates a session and generates a unique session ID. This session ID is stored in a session cookie (or a “Remember-Me cookie” as the FBI calls it) on your browser, which is typically valid for 30 days.

Every time you return to that website within the time frame, you don’t need to log in. That’s really convenient… unless someone manages to steal that cookie from your system.

If someone steals the session cookie, they can log in as you—even if you have MFA enabled.

This is particularly relevant for email handlers that have an online—webmail—component. This includes major players like Gmail, Outlook, Yahoo, and AOL.

With access to your email account, a cybercriminal can find a lot of useful information about you, such as where you bank, your account numbers, your favorite shops, and more. This information could then be used for targeted cyberattacks that only mention information relevant to you, leaving you more likely to fall for them.

Cybercriminals could use your account to spread spam and phishing emails to your contacts. And perhaps most worrying of all, once an attacker is in your email account they can reset your passwords to your other accounts and login as you there too.

How do these criminals get their hands on your session cookies? There are several ways.

On very rare occasions, session cookies can be stolen by you visiting a malicious website, or via a Machine-in-the-Middle (MitM) attack where a cybercriminal can intercept traffic and steal cookies if they’re not protected by HTTPS on an unsecured network.

However, session cookies are usually stolen by malware on the your device. Modern information-stealing malware is capable of, and even focuses on, stealing session cookies as part of its activity.  

How to keep your email account safe

There are a few things you can do to stay safe from the cookie thieves:

  • Use security software on every device you use.
  • Keep your devices and the software on them up to date, so there aren’t any known vulnerabilities on them.
  • Decide whether you think it’s worth using the Remember me option. Is convenience worth the risk in this situation?
  • Delete cookies, or—even better—log out when you are done. That should also remove or invalidate the session ID from the server, so nobody can use it to log in, even if they have the session cookie.
  • Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission.
  • For important accounts regularly check the log in history where you can see which devices logged in when and from where. You should be able to find this option in your account settings.

Comments

Post a Comment

Please no profanity or political comments.

Popular posts from this blog

Why Auto Lending Is Starting To Stand Out As A Real Threat To CUs

  By Ray Birch MILWAUKEE—Auto lending is emerging as one of the biggest areas of risk for credit unions, even as the broader U.S. economy continues to perform better than many expected, according to Bill Handel, chief economist at Raddon, a Fiserv company. Delinquency trends in auto portfolios are now approaching levels last seen during the Great Financial Crisis, Handel said, driven by a combination of high vehicle prices, elevated interest rates and increasing financial pressure on lower-income consumers. “There’s probably still a lot of risk in the auto portfolios,” Handel said. “Our numbers in terms of delinquency behavior in the United States are now rivaling what they were during the Great Financial Crisis.” Economy Holding Up Better Than Expected Despite those pockets of risk, Handel said the broader economy remains surprisingly resilient. “If you look at the U.S. economy, it’s actually performing quite well—probably better than most people would have anticipated,” he said. ...
Post a Comment
Read Complete Article HERE>»

When Cooperation Turns To Competition: A Turning Point For The Firefighter Credit Union Movement

  By Grant Sheehan For decades, firefighter credit unions have stood as a model of what cooperative finance is meant to be—institutions built not to compete ruthlessly, but to serve a shared mission: supporting the financial well-being of those who risk their lives in service to others. That’s what makes the recent actions of Firefighter First Credit Union so concerning. Firefighter First FCU was not just another participant; it was a founding member of the National Council of Firefighter Credit Unions (NCOFCU). It helped shape the very principles of collaboration, mutual respect, and non-encroachment that have long defined our community. Those principles weren’t accidental; they were intentional safeguards to ensure that firefighter-focused credit unions could grow together, not at each other’s expense. But something has changed. Firefighter First FCU’s decision to pursue a nationwide charter marks a clear shift in direction—from cooperation to direct competition. This isn’t simpl...
Post a Comment
Read Complete Article HERE>»

Small Credit Unions Don’t Lack Representation—They Lack Board Education

  By Grant Sheehan Let’s be clear— representation  for small credit unions is not something new that suddenly needs to be invented. For more than 150 years in Europe and 115 years in the U.S., many of us—along with numerous trade groups representing postal workers, schools, hospitals, the military, first responders, electricians, welders, auto workers, and many other sponsor employee groups—have been actively representing and supporting small credit unions. The mission has always been the same: protect these institutions and ensure they have a voice. The real challenge facing small credit unions has never been a lack of organizations claiming to represent them. The challenge has been engagement and education. Many small credit unions operate with extremely limited resources. Their boards are made up of volunteers who already have full-time careers. Even when scholarships, training opportunities, and conferences are offered, the realities of travel costs, staffing shortages, op...
Post a Comment
Read Complete Article HERE>»

With Graham Signaling New Budget Bill, Credit Unions Brace For Tax Debate

By Ray Birch WASHINGTON— Senate Budget Committee Chairman Lindsey Graham’s comments Wednesday that Republicans will “expeditiously move toward creating a second budget reconciliation bill” are giving new shape to what had been a speculative discussion in Washington—and prompting renewed attention within the credit union industry to whether the movement’s federal tax exemption could again surface as lawmakers look for possible offsets. In a post on X, Graham said that after consulting with President Trump, his team and Senate Majority Leader John Thune, the Senate Budget Committee will move quickly on a second reconciliation package focused on “adequate funding to secure our homeland” and support for the military. The remarks are notable because they offer one of the clearest indications yet that a second fast-track budget measure—previously discussed but far from certain—may now be gaining traction. CUToday.info on Wednesday reached out to House Budget Committee Chairman Jodey Arringto...
Post a Comment
Read Complete Article HERE>»

Sunday Reading - How were the National Parks started?

  America's 'Best Idea'       How were the National Parks started? America's National Park System includes roughly 85 million acres of US territory, equal to the size of Germany, set aside by federal law for preservation. There are 63 areas officially designated as national parks—including the Grand Canyon, the Great Smoky Mountains, and Acadia—and more than 400 additional smaller units ( see map ). In 1872, Yellowstone was established   as the first national park dedicated to public enjoyment and recreation, though its foundation also  displaced several Native American tribes . By 1916, the growing system required the creation of the National Park Service to preserve its lands for future generations. Eventually, hunting and logging were banned in the parks, though regulated extractive activity is still permitted in nati...
Post a Comment
Read Complete Article HERE>»

Setting & Meeting Your 2018 GOALS - Dan Berger

A new year provides a fresh start and a clean slate and is often the time when resolutions and goals are established. If you are in the process of setting new goals – as I am – know that with an open mindset, achievement of all your goals is possible. "Goals provide clarity," writes Mareo McCracken, revenue leader of Movemedical. He explains that goal setting is about "combining the fortitude to achieve with clear thinking while making sense of your purpose and defining your ability to deliver value to others." However, goal setting and achieving also requires faith – or believing and hoping in something you can't see yet or that doesn't quite exist. For many of us, the No. 1 reason we don't achieve our goals is that we lack belief in ourselves and our abilities. I encourage you to read an article by Inc.com contributor Benjamin Hardy  that details the importance of having this kind of faith in yourself and delivers some tips on how to achie...
Post a Comment
Read Complete Article HERE>»

Lifesaving Companion Dog Takes On New Role With Injured Firefighter « CBS New York

Lifesaving Companion Dog Takes On New Role With Injured Firefighter « CBS New York : "NEW YORK (CBSNewYork) — A badly injured New York firefighter received a companion dog whose already saved people’s lives from fire. As CBS2’s Dave Carlin reported, disabled firefighter Tom Prin beamed as he was officially presented with his new canine companion Halona inside of a packed ceremony in Suffolk County. The former firefighter was one of 15 people receiving their canine companions. Prin was chosen because of what he’s been through — after fracturing his neck and back while responding to a Brooklyn fire. “When I was going from the third to fourth floor, the steps gave out and I fell through the fire escape,” he said. Prin has endured five spinal surgeries, but the Holtsville man will now be comforted by Halona who has quite the lifesaving resume herself." Click HERE to read full story and see video 'via Blog this'
Post a Comment
Read Complete Article HERE>»

Tower Climb NYC Registration Now Open!

     
Post a Comment
Read Complete Article HERE>»

How to Prepare for a Recession

  By Ray Birch IRVINE, Calif.—There’s little chance the Federal Reserve will steer the U.S. away from a recession in the next 12-18 months, says one economist, who adds delinquencies among the nation’s lenders could become an issue in the near future. Elliot Eisenberg, chief economist for economic consultancy GraphsandLaughs, said during a recent Origence webcast he does not think the recession will be deep. But he also urged credit unions to revisit loan loss reserves built during the pandemic and to shore those up again. What the growth of inflation will come down to, explained Eisenberg, is whether the Federal Reserve, as it adjusts rates upward to curb inflation, will be able to engineer a “soft landing” for the econo...
Post a Comment
Read Complete Article HERE>»