Session hijacking
A technique of stealing the session token of an already authenticated user, to access the user's accounts with no password or second factor; it has made classic multi-factor authentication insufficient.
Once a user has authenticated to an online service, the server issues a session token, often stored in a cookie, which spares the user from re-entering credentials at every step. Whoever holds this token is treated as the user, second factor included. Session hijacking exploits this mechanism. It takes two main routes. Information-stealing malware, installed on the victim's computer, harvests browser cookies and resells them on specialized markets. Adversary-in-the-middle phishing kits sit in real time between the victim and the real site: the victim enters password and code, the kit relays them, and captures the session token issued in return. In both cases, multi-factor authentication worked, and the attacker gets in anyway. This technique has become one of the main routes to compromising corporate mailboxes and online admin consoles. Countermeasures are phishing-resistant authentication bound to the legitimate domain, binding the token to the device, short session lifetimes and detection of anomalous logins. For insurance, it explains the rise in payment fraud despite seemingly solid controls.
Textbook case: a CFO clicks a link to a fake login page identical to her mailbox's. She enters her password and code; the kit captures her session. The attacker reads her exchanges for two weeks, then sends a supplier a request to change bank details.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.