andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Passkeys let developers authenticate users more securely and without phishing risks. However, several subtle nuances may lead them to some misconceptions.

Passkeys replace passwords for user authentication, provide a better user experience, offer more security and phishing resistance. However, there are some subtle nuances that can confuse developers. Let’s dig into some of them.


<AmpContent>
<amp-youtube
    data-videoid="Az3YR0mR6co"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div class='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/Az3YR0mR6co' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>


> This article is not an introduction to passkeys. It assumes that you, as a developer, have some general knowledge about them and are looking for clarification about some confusing concepts.
>
> If you are new to passkeys, you can learn more by visiting [learnpasskeys.io](https://learnpasskeys.io).

## Where Are the Specs for Passkeys?

The term *passkey* is [a common noun](https://passkeys.dev/docs/reference/terms/#passkey) in the same way that password is. It's not a product name, and it's not a formal technical name such as [ID token](https://auth0.com/blog/id-token-access-token-what-is-the-difference/) or [JWT](https://jwt.io/introduction). However, a widely accepted definition from the FIDO Alliance [defines passkeys](https://fidoalliance.org/passkeys/) as "*a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices*".

The FIDO Alliance also provides a technical definition of passkeys: "*passkeys are FIDO credentials that are discoverable by browsers or housed within native applications or security keys for passwordless authentication*".

In other words, while **the term passkeys is common** in everyday conversation, it identifies something that is formally defined by a set of technical specifications: [FIDO2/WebAuthn](https://fidoalliance.org/fido2/). Keep reading to learn a bit more about these specifications.

By the way, you should not capitalize the term passkey as if it were a product name. It should follow the capitalization rules of any common noun, as with the term password.

## Passkeys, FIDO, and FIDO2

Some recurring terms around the passkey definition may confuse many developers: FIDO, FIDO Alliance, FIDO2. What are they? What is the relationship between them?

[FIDO](https://fidoalliance.org/what-is-fido/) stands for *Fast IDentity Online* and refers to an initiative to solve the password problem in user authentication. The same name is used to identify the set of standards that allow user authentication through cryptographic keys, although the correct name should be *FIDO Authentication*.

[FIDO Alliance](https://fidoalliance.org/overview/) is the name of the open industry association that carries on the Fast IDentity Online (FIDO) initiative. Among its members, you can find Apple, Microsoft, Google, and Amazon.

[FIDO2](https://fidoalliance.org/fido2/), or rather FIDO2 Authentication, is one of the FIDO Alliance's technical specifications for enabling passwordless strong authentication. Specifically, FIDO2 Authentication is the set of standards that passkeys rely on. FIDO2 Authentication includes the [W3C WebAuthn](https://www.w3.org/TR/webauthn-2/) specifications and the [FIDO Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html) specifications. These are commonly referred to together as “FIDO2/WebAuthn”.

The WebAuthn specification defines how web-based relying parties can interact with passkeys in a browser, while CTAP allows the implementation of Cross-Device Authentication (CDA), i.e., it enables communication between a client/platform and an external authenticator.

## Passkeys and FIDO Credentials

The technical definition of passkeys refers to FIDO credentials. What are they?

**FIDO credentials,  also known as WebAuthn credentials, are cryptographic key pairs** based on [public-key cryptography](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/) and used for authentication. With FIDO credentials, the authentication process is not based on a shared secret, as it happens with passwords. On the contrary, the user shares the public key with the authentication server at the time of registration. Sharing the public key does not compromise the security of the user identity: it's public information that can be shared without any risk. To authenticate, the user must demonstrate that they are in possession of the corresponding private key. This is accomplished by signing a challenge (a randomly generated value) with the private key.

So, the core building block of the passkeys infrastructure is a public-private key pair called FIDO credentials. From a technical perspective, we can identify passkeys with special FIDO credentials. What is so special about these FIDO2/WebAuthn credentials compared to traditional ones? They are **discoverable**, which means that an authenticator is able to detect the private key associated with an authentication server (relying party) given its domain. This makes the user experience smooth and convenient since they don't even need to send their username to the authentication server.

## Passkeys and WebAuthn

You may have heard of passkeys in conjunction with WebAuthn and are wondering what their relationship is. As mentioned earlier, passkeys rely on FIDO2 Authentication, which is based on two specifications: [W3C Web Authentication (WebAuthn)](https://www.w3.org/TR/webauthn-2/) and [FIDO Client to Authenticator Protocol version 2 (CTAP2)](https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-errata-20220621.html).  While CTAP2 defines how devices can communicate with external authenticators, WebAuthn defines how browsers can manage FIDO credentials for user registration and authentication.

WebAuthn defines a JavaScript API to allow a website to request the creation of a new passkey and get proof of possession of the private key. By using this API, a website can't access the private key of the cryptographic key pair, but it can request the authenticator to sign a challenge with that private key. This proves that the user controls the private key, which is what proves the user's identity.

To summarize, a passkey is a credential that allows a user to prove their identity, while WebAuthn is a standard API that allows an application to create and use passkeys for sign-in.

## Passkeys and Biometrics

A common misconception is that passkeys let users authenticate via their biometrics, such as their fingerprint or their face. While using biometrics is one of the ways to complete the authentication process with the relying party, saying that passkeys let you authenticate through biometrics is not accurate.

The relying party has no access to your biometrics. Your fingerprint and your face data are stored locally in your authenticator device, so the relying party cannot authenticate you based on your biometrics. It authenticates you as the holder of the private key part of your passkey. Biometrics are used locally to let you access your authenticator and prevent a malicious person from using your authenticator. To be precise, [a biometrics-based authentication exists](https://auth0.com/blog/a-tale-of-two-biometrics-styles/#On-Device-Biometric-Authentication), but it is local and does not involve the relying party. 

In addition, you are not required to use biometrics to access your authenticator unless the relying party forces this requirement. In some contexts, you can just use a PIN or draw a pattern to access your authenticator. The use of biometrics, PIN, or other interactions with the authenticator is known as an [authorization gesture](https://www.w3.org/TR/webauthn-2/#authorization-gesture).

## Passkeys Are Not Accounts

Another common misconception about passkeys is that they are the same as user accounts. You can find some [threads](https://developer.apple.com/forums/thread/711023) [about this](https://www.reddit.com/r/Passkeys/comments/14sj4yd/multiple_accounts_on_a_single_device/) [confusion](https://developer.apple.com/forums/thread/732735) all around.

A user account can be defined as the representation of the identity of a user in a given context. For example, your Google account identifies you in the Google ecosystem, i.e., in the set of applications and services that Google provides you. Your Apple account identifies you in the Apple ecosystem, and so on.

To prove your identity to Google when you access one of its applications, you need to provide your credentials, such as a password or a signed challenge, in case you are using a passkey.

Your credential is not your identity/account. It allows you to prove your identity, but it's not *the account*. You can change your credentials, but your account remains the same.

In the context of passkeys, you can add a passkey to your account. You could even add multiple passkeys to your account. If you remove your passkey (or one of your passkeys) from your account, you are not deleting your account. You are just removing a way to prove your identity.

Think of your passkeys as you think of your passwords.

## Passkeys Are Not (Necessarily) Hardware-based

While many FIDO authenticators are based on hardware devices, [FIDO2/WebAuthn does not require this](https://www.w3.org/TR/webauthn-2/#authenticator). The specifications explicitly say that an authenticator can be implemented via software. This means that the public and private key pair is created by the software and is stored on the file system after encryption.

A software authenticator can be part of the operating system or an independent application. While a hardware authenticator does not allow you to export the private key stored on it, a software authenticator is more flexible. In fact, synced passkeys rely on a software application or operating system subsystem to export their private key to the cloud and then share it with other devices.

## Passkeys Are Not Only for the Web

A common misconception about passkeys is that they are meant only for web applications. Perhaps this is due to the fact that WebAuthn is a W3C standard, which essentially involves browsers. In fact, you can use passkeys for desktop and mobile applications, too.

You can use two approaches to get passkey support into your native applications:

- **Use the browser to authenticate the user**. You can delegate user authentication to an external browser or system webviews. In this case, user authentication relies directly on WebAuthn, as it happens with web applications. After authentication, the user is redirected back to the native application with a token proving it succeeded.
- **Use your platform-specific abstraction of the WebAuthn API**. Platforms provide you with native implementations to manage passkeys in your applications. For example, you can use [Credential Manager](https://developer.android.com/training/sign-in/passkeys) to support passkeys in Android and [specific APIs for macOS and iOS](https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys). 

## The Role of Authenticators

Authentication using passkeys relies on authenticators, which are hardware or software components capable of managing cryptographic key pairs. You can have two types of authenticators:

- **Platform authenticators**. These authenticators are integrated into your device or are modular software components running on your device. Usually, they are not removable from your device. Examples of platform authenticators include Google Password Manager, Apple iCloud Keychain, Windows Hello, 1Password, Bitwarden, and Dashlane.
- **Roaming authenticators**. These are authenticators that can be used on a device other than the one on which the user is authenticating. Examples of roaming authenticators are security keys or smartphones.

While this classification may seem simple to understand at first look, keep in mind that **the authenticator type is more a matter of role than inherent characteristics**. In other words, a specific authenticator can act as a platform authenticator in one context and as a roaming authenticator in another.

Consider the case of the authenticator embedded in a smartphone. When the user authenticates to an application running on the smartphone, the smartphone's authenticator is a platform authenticator. When the user uses the same smartphone to authenticate to an application running on a laptop via Cross-Device Authentication, the smartphone is a roaming authenticator.

The rule of thumb to determine what is the current role of an authenticator is:

- Has your device a built-in authenticator, and you are using it to access an app or website on the same device? If so, it’s a platform authenticator.
- Has your device a built-in authenticator, but you are using it to let another device access an app or website? Then it’s a roaming authenticator.

As a final note, while as per [definition](https://www.w3.org/TR/webauthn-2/#authenticator), the authenticator is just the subsystem able to manage cryptographic key pairs, it's common to call the entire device the authenticator. So, don't be surprised if you hear someone say they use their smartphone as an authenticator.

## Not All Passkeys Are the Same

You might have heard that there are different types of passkeys, and you may have heard different confusing names for them: single-device, multi-devices, synced, device-bound. Let's try to put order in this naming.

The currently accepted naming for passkey categorization is as follows:

- **Device-bound passkeys**. These types of passkeys are bound to a single authenticator, i.e., the authenticator that created them. Once a passkey has been created, it cannot leave the device where it was created. As an example, consider a security key: you can't move the passkey created with this authenticator to another device.
  For a very short period of time, this was referred to as a *single-device passkey*, but that name is no longer used.
- **Synced passkeys**. These are passkeys that can leave the authenticator in which they were created and move across devices via the cloud. The passkeys are end-to-end encrypted and synced to all of a user’s devices using the same provider. This enables sharing them with all the devices of a user associated with the same passkeys provider account, such as Apple ID, Google account, 1Password account, Bitwarden account, and so on.
  For a very short period of time, these were referred to as *multi-device passkeys*, but that name is no longer used.

## Passkeys, Single Sign-On, & C.

You learned that passkeys are a new way to authenticate the user in a much more secure and convenient way than other traditional forms of authentication, first and foremost, username and password. But how does [Single-Sign On (SSO)](https://auth0.com/docs/authenticate/single-sign-on) work with passkeys? Can we continue to use one account to access multiple applications, or do we have to create a new passkey for each application while using the same account?

Actually nothing changes when you use and implement SSO in your applications. Passkeys introduce a new way to authenticate a user but do not change how to manage the resulting authenticated session. In other words, once the authentication server has authenticated the user, it can generate the authentication cookie just as it did with password-based authentication. Passkey and SSO can coexist seamlessly.

Similarly, passkeys and OpenID Connect or OAuth 2.0 coexist. There is no overlap. After a passkey-based authentication, the identity provider or authorization server may issue the required tokens as usual.

<include src="LearnPasskeysCTA" />

## Summary

Passkey technology is proven and solid, but some internal complexity may lead to some misconceptions. This article went through a few of them, trying to explain how things are. If you have any other doubts about passkeys and the technologies behind them, please leave a comment below.


Common Developer Misconceptions About Passkeys

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

"Passkey" is the shorthand for FIDO multi-device credentials, a new technology that makes it convenient to use FIDO's phishing-resistant authentication methods and ceremonies across multiple devices.

Our Take on Passkeys

MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

How text messaging scams work and why a ‘skeptical pause’ can save you

You know _all_ about phishing. From time to time, emails purporting to be from Facebook or your bank drift into your inbox and insist you “verify your account.” Look closer and you spot the telltale signs of a scam: a sketchy-looking sender address, sloppy writing, and a complete lack of personalization. You sigh and hit delete.

It’s easy to be cynical about opportunistic, mass-mailed phishing attempts. Although some look genuine to even the most cautious eye, others feel decidedly amateurish and are readily identifiable. Billions of emails are sent each month, with over 245,000 phishing-related websites created in January alone [according to the Anti-Phishing Working Group (APWG)](https://docs.apwg.org/reports/apwg_trends_report_q1_2021.pdf). But when it comes to SMS-based phishing, or ‘smishing,’ things are a little different.

Smishing is when a malicious actor harvests credentials and credit card details by pretending to be someone else over text. This novel spin on phishing has grown exponentially in recent years, with the volume of messages sent to North American phones [increasing by 328% in Q3 2020 alone](https://www.proofpoint.com/us/blog/threat-protection/mobile-phishing-increases-more-300-2020-chaos-continues). Similar trends can be found in other territories. In the UK, one survey found 61% of respondents received [at least one smishing text during 2020](https://www.which.co.uk/news/2021/06/three-in-five-people-have-received-a-scam-delivery-text-in-the-last-year/).

For the perpetrators, smishing can prove incredibly lucrative. For the victims, it can be financially devastating. This article will explain how the scam works, why it’s effective, and how individuals and organizations can fight back.

## How a Smishing Scam Works

If you’re reasonably tech-savvy — or have listened to the dire warnings issued by tech companies, financial institutions, and governments — chances are high you understand the risk posed by traditional email-based phishing.

You know that email accounts can be created and hijacked. Spammers can even spoof the origins of an email. And, after countless high-profile data breaches, you may have grudgingly reconciled with the reality that your personal information is irrevocably available online.

Smishing scams, on the other hand, feel comparatively opaque. How do attackers successfully impersonate well-known brands? How do they operate at such a large scale, sending tens of thousands of messages at a time?

Let’s start by looking at the methodology. Attackers have plenty of options when it comes to the bulk distribution of text messages. They may choose to buy a device created explicitly for that purpose, with examples available online for just a few hundred dollars. Alternatively, they can use a standard mobile phone or USB cellular modem, combined with an automation program that costs just $69.

This isn't the most inconspicuous method. In June, UK law enforcement were [called to a hotel in Manchester](https://www.gmp.police.uk/news/greater-manchester/news/news/2021/june/man-arrested-in-manchester-hotel-after-over-25000-phishing-messages-sent-in-one-day/) after staff became suspicious of a guest carrying a bag filled with unusual-looking wires and electrical devices. Upon inspecting his room, police found a laptop containing 44,000 mobile numbers, as well as an SMS hardware gateway. They later determined the device was used to send 26,000 messages in the previous day alone.

Alternatively, as pointed out by veteran cybersecurity journalist Brian Krebs, attackers may choose a provider to send the messages out on their behalf. Earlier this year, UK authorities arrested the 20-year-old operator [behind the SMS Bandits gateway](https://krebsonsecurity.com/2021/02/u-k-arrest-in-sms-bandits-phishing-service/#comment-527047), which he marketed within criminal circles as “spam friendly.” Messages sent via SMS Bandits impersonated government agencies, financial services organizations, and telecommunications providers.

Now, let's talk about the composition of the text. SMS messaging is a relatively ‘flat’ medium. There is no room for a visual flair or branding. This works to the advantage of attackers, as they don’t have to painstakingly recreate the style of the organizations being impersonated. And many phishing approaches works

Within the body of the text, the attacker faithfully adheres to the phishing playbook. One common tactic is to create a false sense of urgency. They want the recipient to be anxious, as they’ll be more likely to hand over their credentials without scrutinizing the message too closely.

The pandemic has provided many examples of this. In May, a UK man was sentenced to 4 years and three months imprisonment after perpetrating a scam where [victims were asked to provide their bank details](https://www.cps.gov.uk/cps/news/covid-19-fraudster-jailed-mass-cyber-scam) in order to verify their eligibility for a Covid vaccine.

Another SMS phishing campaign [identified in South Africa in March 2020](https://www.f-secure.com/gb-en/consulting/our-thinking/how-smishing-uses-urgency-to-manipulate-victims-during-lockdown) purported to be from local financial institutions and warned the recipient that their account would be terminated if they didn’t verify their credentials.

It’s interesting to note that this campaign began during the early months of the first lockdown, at a point when many contact centers were operating at a vastly reduced capacity. The ensuing long wait times ultimately disincentivized recipients from trying to independently verify the message with their bank, which contributed to its success.

## Why is Smishing so Effective?

It's hard to find solid data on the financial cost of smishing. In most cases, it is grouped together with traditional email phishing and ‘vishing’ (voice phishing), rather than a standalone category. However, police reports and testimony from victims suggest it can be hugely profitable for the perpetrators.

One [gang made at least £20m over just eight years](https://inews.co.uk/news/pair-jailed-for-text-message-fraud-that-swindled-20m-from-bank-customers-and-funded-luxury-shopping-sprees-911561), allowing them to live a celebrity lifestyle of five-star hotels and designer clothing brands. Another man, [a 22-year-old computer science student from London](https://www.ukfinance.org.uk/press/press-releases/enfield-student-behind-scam-texts-jailed-22-months), made £125,000 before his arrest. In 2019, a Georgia federal court convicted three Romanian men for their role in a smishing scheme that [cost individuals and institutions an estimated $21M](https://www.justice.gov/usao-ndga/pr/three-romanian-citizens-plead-guilty-participating-multi-million-dollar-vishing-and).

And then there are the victims. One Hong Kong flight attendant saw [her $10,000 life savings](https://www.scmp.com/news/hong-kong/law-and-crime/article/3141567/hong-kong-sees-sharp-rise-phishing-scams-victims) drained after she clicked through a text purporting to be from her bank. A student in the UK was pushed [into her overdraft after receiving a text ostensibly from Barclays Bank](https://www.bbc.co.uk/news/uk-england-birmingham-56500599). Another woman in Topeka, Kansas [lost $600](https://www.ksnt.com/news/local-news/topeka-woman-falls-victim-to-text-message-scam-warning-others-what-to-look-for/).

So, why is it so effective? It falls down to a number of reasons.

*   Smishing is a relatively novel phenomenon, especially when compared to traditional email phishing, and much of its growth has occurred in recent years. In the UK, the volume of smishing messages [grew 700% in the first six months of 2021 alone](https://news.sky.com/story/smishing-reports-increase-nearly-700-in-first-six-months-of-this-year-12407504). There isn't the same level of awareness, and therefore, skepticism, among the wider populace.
*   Text messages have a visibility advantage over emails. While your Gmail inbox may contain thousands of unread messages, odds are good you read every single text that shows up on your phone.
*   For scammers hoping to establish credibility, SMS messages are hard to get wrong. As mentioned, it is a purely plaintext medium, with no visual flair to mimic.
*   This simplicity allows scammers to quickly respond to events. Delivery scams — which account for over half of all smishing attempts in the UK — are a good example, having proliferated after the UK concluded its withdrawal from the EU. In the US, smishing epidemics have coincided with the distribution of stimulus checks, tax season, and the widespread difficulties in obtaining unemployment insurance during the early months of the pandemic.
*   Finally, many of the tactics that make traditional email phishing successful also work over text, such as the creation of a false sense of urgency.

## Fighting Back

It’s easy to dismiss smishing as a purely consumer problem. That would be a mistake. First, there is an overlap between the tools and services used by the general public, and those used by the public and private sectors. Gmail is a good example. You might also use the same bank or the same social media platforms.

Additionally, there are many examples of text messages being used to distribute malware, or as the basis for a spear-phishing campaign. This raises the prospect of smishing becoming a major headache for public and private-sector organizations.

That all said, SMS remains a prime mode of communication due to its ease of use and sheer ubiquity. Although services like WhatsApp and Facebook Messenger offer more functionality, you can’t beat the humble text message for sheer universality.

An [estimated 96% of US adults](https://www.smscomparison.com/mass-text-messaging/2021-statistics/) own a device capable of receiving text messages, while 95% of SMS messages are read and responded to within three minutes of receipt.

It's therefore crucial that organizations proactively develop a strategy for combating smishing, with awareness at the heart of any such strategy. Employees and partners must understand that text messages are not inherently safe. They should be treated with the same level of cautiousness as email.

Employees should also feel empowered to report suspected smishing scams targeting the business. The sooner an organization becomes aware of an attack in progress, the quicker it can act.

Auth0 Security Culture Manager Annybell Villarroel notes that we’re seeing an increase in smishing attempts and recommends creating a culture of security and awareness for employees and partners through regular training.

But the biggest thing for all of us is just to learn to take a “skeptical pause,” says Annybell. “Pausing to ask yourself if the message makes sense can make a big difference. It can take you out of an emotional response back to logic. That extra few seconds can save you from a smishing click.”

What is Smishing?

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

Phishing is the most common cyberattack vector today, and yet people still fall for it. We look at the causes and possible solutions.

Why Phishing Attacks Work

annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

How to safeguard yourself and your company against phishing attacks on identity



Do you remember the last time you fell or almost fell for a phishing email? I do.

I received an email on my phone, apparently from an Amazon.com email address, that said, “Unlock your Amazon account.” Although this was unexpected, it was feasible because I had made a purchase on Amazon recently and had changed settings that could have locked the account.

Concerned, I opened the email.

The design matched Amazon’s style, there were no typos, and my phone’s email app interface showed me just the sender’s name rather than their email. I inspected the link the email asked me to click and noticed it was fake.

It was one of the best phishing emails I’ve received recently. It managed to make me feel concerned while reading it. That’s the key.

Phishing is both simple to implement and effective. It’s a relatively low-effort attack that can have a high reward. According to Verizon’s [2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/dbir/), attackers used phishing in 22% of the investigated breaches. The quality of the attacks varies from the obviously fake to sophisticated spearphishing campaigns that are fully customized.

The most effective phishing emails are typically those that tap into strong emotions that drive action. In _Thinking, Fast and Slow_, Daniel Kahneman, Nobel Laureate in Economics, proposed that humans have two modes of thought: “System 1,” which is fast, instinctive, emotional, and “System 2,” which is slower, more deliberative, and more logical. Humans feel before we think. We are emotional beings. That’s why phishing attacks that appeal to our emotions (anxiety, fear) are more effective. 

## Phishing Attack Goals 

Phishing attacks tend to have three main goals:

### Credential theft

Credential theft typically involves a link that sends the user to a fake look-alike website that requests credentials to login.

If the account is not properly secured with methods like [multi-factor authentication (MFA)](https://auth0.com/docs/mfa), the credentials obtained could result in an account takeover. The compromised account could then be used to access internal systems, which could cause a data breach that could have compliance-related consequences under data privacy laws such as the [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA).

### Business email compromise

This kind of attack involves impersonating an executive to trick someone into transferring funds or buying gift cards. This could have a high financial cost to the organization if it succeeds.

### Malware delivery

Malware delivery usually involves downloading an infected document or app that can cause a high-impact disruption, like what happened with the [2017 WannaCry ransomware attack](https://www.malwarebytes.com/ransomware/).

## Preventative Measures

The following measures can help you protect yourself, your employees, and your users from phishing attacks:

### Security awareness

Empowering users to detect and report phishing attacks helps protect the organization no matter the type of phishing. It also helps the security team react faster, thanks to their reports. We’re providing a free user awareness guide to help you raise awareness internally, and we’ve released some of our internal phishing training in our YouTube channel voiced by someone you would not expect. 😉

### Multi-factor authentication (MFA)

MFA protects your employees from an account takeover in the event of credential theft. Implementing and rolling it out is very easy with Auth0.

### Endpoint protection

Antivirus solutions can protect your employees in the event of malware. There are plenty of options for the enterprise, so choosing one that fits your organization and culture will boost your defenses with minimal disruption.

### Verification processes for payments and invoices

Establish an internal verification process that requires multiple people to approve a payment or expense before wiring the money, and define specific methods to do so (e.g., no gift cards).

On top of all of this, it’s key that users have an easy way to report these attacks to your IT or security team, such as a dedicated corporate email address, and that the team can efficiently respond to these reports.

## A Constant, Evolving Threat

Phishing is an ever-evolving threat that’s constantly present for most companies across all industries, as well as most end-users. Whether it’s generic bait or a message adapted to the circumstances of the moment, phishing can happen at any time to any company or any user. Rather than being overwhelmed by the challenge, training employees, creating and sharing clear processes, and enabling measures like enforced MFA can be the difference between a bad data breach and creating a resilient organization with the ability to adapt in an evolving threat landscape.

To learn more about how to protect your valuable data from attack, explore [Auth0 Resources](https://auth0.com/resources/).

<include src="asides/AboutAuth0" />


Protecting Against Phishing Attacks

Here’s how you can protect your customers, your employees, and yourself



Do you remember the last time you fell, or almost fell, for a phishing email? I do.

I received an email notification while I was checking my phone: “Unlock your Amazon account”, apparently coming from an amazon.com address. Although unexpected, it was feasible, I had made a purchase on Amazon recently and had changed settings that could have locked the account. 

Concerned, I opened the email.

The design matched Amazon’s style, there were no typos, and my phone’s email app interface just showed me the sender’s name rather than their email. I inspected the link and noticed it was fake.

It was one of the best phishing emails I’ve received in recent times. It managed to make me feel concerned while reading it. That’s the key.

Phishing is both simple to implement and effective. A relatively low-effort attack that can have a high reward. According to Verizon’s [2020 Data Breach Investigations Report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf), attackers used phishing in 22% of the investigated breaches. The quality of the attacks varies: we can go from the obviously fake, to sophisticated spear phishing campaigns that are fully customized.  

The most effective phishing emails are typically those that tap into strong emotions that drive action. In “[Thinking, Fast and Slow](https://www.amazon.com/dp/B00555X8OA/ref=dp-kindle-redirect?_encoding=UTF8&btkr=1)” Daniel Kahneman, Nobel Prize of Economics, proposed that humans have two modes of thought "System 1" which is fast, instinctive and emotional, and "System 2" which is slower, more deliberative, and more logical. Humans feel before we think. We are emotional beings.   

![phishing-separator-1](https://images.ctfassets.net/23aumh6u8s0i/4fRwjLa60geXQsStXAkFkv/b350326d596f0fdca3a5d650b9e35933/phishing-separator-1)

[Coronavirus presents a wonderful opportunity for cybercriminals to exploit our emotional selves](https://auth0.com/blog/coronavirus-and-cybersecurity-how-your-business-can-stay-safe/), “System 1”, much easier. It’s a situation that’s intrinsically concerning, and that demands a high level of engagement to stay updated with the latest alerts and announcements. Imagine the spectrum of campaigns that would tap into a strong emotion:

* Concern / Fear: Infected near you, new negative effects, tracking apps
* Curiosity: remote work, fake cures or vaccines, meeting requests, refunds, fake package delivery
* Despair / Necessity: Medical equipment, financial aid
* Compassion / Kindness: Charitable contributions

Imagination is the limit. 

## What’s the Landscape as of May 2020?

The [COVID-19 Cyber Threat Coalition](https://www.cyberthreatcoalition.org/about-us/our-mission), a coalition of cybersecurity experts working to protect individuals and organizations from COVID-19-related cyber threats, releases weekly threat advisories. Phishing appears constantly in these posts, as it’s one of the most prominent threats organizations face.

The phishing landscape has changed significantly since the pandemic started. Shortly after COVID-19 was officially declared a pandemic by the [World Health Organization (WHO)](https://www.who.int/) on March 11th, registrars saw a spike in COVID-19 related domain name registrations, with a peak of around 5000 high-risk domains registered per day in the week of March 16th. 

This number has gradually decreased since then, especially after domain registrars were requested to [increase scrutiny around COVID-related sites](https://www.zdnet.com/article/new-york-asks-domain-registrars-to-crack-down-on-sites-used-for-coronavirus-scams/) by the New York Attorney General.

![phishing-graphic](https://images.ctfassets.net/23aumh6u8s0i/3AwdeH8uutY4HUEDiZqn1b/ac8a8ac47f023ab5219a96729b2ae318/phishing-graphic-2)
<p align="center">Source: DomainTools</p>

However, as per the latest [advisory from the Cyber Threat Coalition](https://www.cyberthreatcoalition.org/advisories/2020-05-20-weekly-threat-advisory-domain-trends), it seems that the domain registrations shifted to the latest trend in the pandemic: masks. 

[Google’s threat analysis group reported](https://www.blog.google/technology/safety-security/threat-analysis-group/findings-covid-19-and-online-security-threats/) that they’re detecting 18 million malware and phishing Gmail messages per day related to COVID-19, with health organizations and health agencies becoming targets as a result.

## What Can We Do to Protect Ourselves And/Or Our Companies From This Constant Threat? 

Phishing attacks tend to have one of these three main goals:

1. **Credential Theft**

    Typically involving a link that sends the user to a fake look-alike website that requests credentials to login. 

    If the account is not properly secured with methods like [Multi-Factor Authentication](https://auth0.com/docs/mfa) (MFA), the credentials obtained could result in an account takeover. The compromised account could then be used to access internal systems, which could cause a data breach that could have compliance-related consequences as per the relevant data privacy laws such as [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA).

2. [**Business Email Compromise**](https://shorturl.at/uFRU4)

    Often involving impersonating an executive to trick someone into transferring funds or buying gift cards. This could have a high financial cost to the organization if it succeeds.

3. **Malware Delivery**

    Usually involving downloading an infected document, or app that can cause a high impact disruption, like what happened with the [WannaCry ransomware attack in 2017](https://www.malwarebytes.com/ransomware/)

These goals can help us categorize the preventive measures we can take: 

![phishing-separator-2](https://images.ctfassets.net/23aumh6u8s0i/7Iis51GXOCFk18pBQBYkAk/dd3f1697da3627feb86af6643a3afc4c/phishing-separator-2)

### Security Awareness 

Empowering users to detect and report phishing attacks helps protect the organization no matter the type of phishing. It also helps the security team react faster thanks to their reports. We’re providing [a free user awareness guide]( https://cdn.auth0.com/blog/phishing/user-awareness-guide.pdf) to help you raise awareness internally, and we’ve released some of our [internal phishing training in our YouTube channel](https://youtu.be/lyF8I-xzZ_k) voiced by someone you would not expect 😉

<iframe width="660" height="315" src="https://www.youtube.com/embed/lyF8I-xzZ_k" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

We wouldn’t recommend doing fake internal phishing campaigns using Coronavirus as bait since it can be too distressing in this situation, and it may hurt trust within your organization. We would recommend rolling out awareness material constantly, explaining what the communication style is in the organization, sending alerts, or sharing examples of real phishing emails transparently, not as a test campaign.

### [Multi-Factor Authentication](https://auth0.com/docs/mfa)(MFA)

MFA protects your employees from an account takeover in the event of credential theft. Implementing it and rolling it out is very easy with Auth0.

### Endpoint Protection

Antivirus solutions can protect your employees in the event of malware. There are plenty of options for the enterprise, so choosing one that fits your organization and culture will boost your defenses with minimal disruption.

### Verification Processes for Payments and Invoices

Establish an internal verification process that requires multiple people to approve a payment or expense before wiring the money, and define specific methods to do so (e.g., no gift cards)

On top of all of this, it’s key to have an easy way for your users to be able to report these attacks to your IT or Security team, such as a dedicated corporate email address, and that the team can [efficiently respond to these reports](https://auth0.com/blog/how-auth0-automates-phishing-response/).

**How can you stay updated on the latest COVID-related phishing trends?**

Here’s where you can more closely monitor the situation as it evolves:

* [FBI alerts](https://www.fbi.gov/coronavirus)
* [Cyber threat coalition](https://www.cyberthreatcoalition.org/): weekly advisory and town hall, IP blocklist, community
* [CISA (US)](https://www.us-cert.gov/ncas/alerts) and [NCSC (UK)](https://www.ncsc.gov.uk/) alerts

Phishing is an ever-evolving threat that’s constantly present for most companies across all industries, and for most end-users alike. Whether it’s a generic bait, or a message adapted to the circumstances of the moment, like COVID-19, tax filing season, or Black Friday, it’s almost guaranteed to be a threat to consider at all times for companies of any size. Rather than being overwhelmed by the challenge, training employees, creating and sharing clear processes, and enabling measures like enforced MFA can be the difference between a bad data breach and creating a resilient organization with the ability to adapt in an evolving threat landscape. 

<include src="asides/AboutAuth0" />


Phishing Goes Viral: COVID-19 Themes in Cybercrime

brandon-maxwell

Brandon is a Senior Security Engineer in Auth0's Detection & Response team. As a proponent of automation, he enjoys automating as many tasks as possible to spend time focusing on solving difficult security problems.

Senior Security Engineer

Brandon Maxwell

Learn how Auth0 uses security automation to generate phishing response at scale



Phishing continues to be a popular attack vector used by attackers with all sorts of motivations — from [_political_](https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html) to [_financial_](https://www.wired.co.uk/article/hr-email-scam-phishing-impersonating-employees) ones. According to Verizon’s [_2019 Data Breach Investigations Report_](https://enterprise.verizon.com/resources/reports/dbir/), 32% of the investigated breaches involved phishing. Most organizations deal with this threat on an almost daily basis, which makes automating the triage for these events an important part of maturing a security program.

In this post we talk about the approach Auth0 has taken to automating phishing in the hopes that it will help other organizations tackle this near-universal threat vector.

## phishing@auth0.com

Auth0 uses the email address `phishing at auth0 dot com` as an "abuse" inbox. We encourage customers and members of the public to report any suspicious Auth0-related emails they receive to this address. In addition, all Auth0 employees are trained to report suspicious emails they receive to this abuse inbox.

In Auth0’s infancy, every email that was sent to the abuse inbox was analyzed manually. A security engineer would review the email body and headers, copy URLs from the body of the emails and analyze them in various intelligence tools, and upload suspicious attachments (or their hashes) to various sandboxes. If the reported email represented a real threat, a remediation process was performed.

This worked great; however, as Auth0 started to grow, the volume of reports to `phishing at auth0 dot com` increased. Email analysis work became time-consuming and was detracting our attention from other higher-impact activities. In other words, it was a perfect use-case for security automation.

## Security Automation

At Auth0, we rely heavily on security automation to ensure we’re not wasting valuable cycles performing repetitive, manual tasks. We partner with the [security automation company Tines](https://tines.io/) in this regard. Every alert from our detection stack, whether it’s from SIEM, GuardDuty, or custom tooling we’ve built, first goes through Tines where it is enriched, prioritized, and ticketed. We also use Tines to automate phishing responses.

## Automated Phishing Response

For the most part, our automated phishing response story maps directly to our previous, manual process and consists of the following high-level steps:

1. Fetch email data and extract indicators
2. Create tracking tickets
3. Analyse indicators
4. Determine if the email represents a real threat
5. Close case if benign
6. Remediate if true positive

### Step 1: Fetch email data and extract IOCs

The first step is to read all emails sent to our abuse inbox. We do this with GSuite’s Gmail API. Once we have the email content, we can extract all URLs and attachments and begin to analyse them. We also recursively open and extract Indicators of Compromise (IOCs) from EML files attached to the originally reported email.

![Flowchart to fetch email data and extract IOCs](https://images.ctfassets.net/23aumh6u8s0i/4kB2PfHEaRZZswUn4bRU6M/d71c7ec982dcde9f05fd943244b2ed13/how-auth0-automates-phishing-response_3Afetch-email-data-and-extract-iocs)

### Step 2: Create tracking tickets

We track and record every single email that’s reported to our abuse inbox in our case management system. Not only does this allows us to track the volume of emails reported over time, but it also allows us to store indicators for future reference and later threat-hunting.

### Step 3 - Analyze indicators

One of the key benefits of automating analysis of indicators is that we can leverage many different intelligence sources without having to worry about wasting an analyst’s valuable time. In our phishing automation story we analyse URLs in:

- VirusTotal
- Urlscan.io
- URLhaus
- PhishTank
- Phish.AI

> **Protip**: When submitting URLs to public sandboxes, remember to first [_redact sensitive information_](https://tines.io/blog/automated-information-leakage/) from URL parameters and never submit links that could be used to reset passwords, etc.

Tines allows us to easily add and remove intelligence sources and experiment with different combinations of sandboxes, without having to change the core flow of the automation story.

![Flowchart to analyze indicators](https://images.ctfassets.net/23aumh6u8s0i/4XqCWGvVyGwl1ttZ140Y7C/8d4b825d58a6cf9b2f4e89089cdf2758/how-auth0-automates-phishing-response_3Aflowchart-to-analyze-indicators)


### Step 4: Determine if the email represents a real threat

Once we have analysed a URL or attachment in all the various intelligence sources and sandboxes, we use the combined results to determine whether the URL represents a legitimate threat and should be remediated/escalated to a human engineer or whether it’s a false positive and we can ignore it. There’s some secret sauce involved in making this determination and we regularly change the criteria used as our requirements adapt.

### Step 5: Close case if benign

If we have determined that all indicators associated with an email are benign, we update the ticket in our case management system and no further action is taken.

### Step 6: Remediate if true positive

If, however, we have determined that the reported email represents a real threat, we perform a number of automated remediation actions. Again, these actions change regularly but include the following:

- Purge the email from all employee inboxes
- Sweep endpoint logs to determine if any employees visited the malicious domain/URL, or downloaded/executed a malicious file
- Proactively share indicators with trusted peers in the InfoSec community
- Quarantine the devices we believe may have been infected
- Contact users who visited and/or interacted with malicious content and provide them with the next steps needed to mitigate any damage
- Reset potentially compromised credentials

Again, for every step that’s taken, evidence is collected and added to the relevant ticket in our case management system. This ensures a complete paper trail is available for every action that’s taken.

## Summary

Security awareness, email sandboxes, and strong multi-factor authentication all play a part in our *defense-in-depth* approach to phishing response. However, an abuse inbox, where employees and customers can report suspicious emails, is an indispensable resource, providing vital insight into on-going and emerging phishing attacks.

By automating triage of our abuse inbox, our security engineers can focus on higher-impact activities such as threat hunting and refinement or detection logic.

<include src="asides/AboutAuth0" />


How Auth0 Automates Phishing Response

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Use penetration testing and 2FA and educate citizens and employees to better anticipate and avoid cyber threats.



On April 7, 2017, at a quarter to midnight, the city of Dallas was hacked.

The perpetrators accessed the City of Dallas's emergency management system and set off 156 blaring alarms—alarms intended to warn people in case of a tornado or hurricane.

It took over an hour and a half for city administrators to understand what had gone wrong and shut the sirens down.

Amid the ongoing digitization of our urban areas, the Dallas incident highlights one of the main dangers that a smart city—for all the good it can do—brings.

Without the right precautions, and without the right security, our smart cities can be just as vulnerable to hacking as our computers and mobile devices.

What happened in Dallas may have been the first high-profile incident of “city hacking,” but it certainly won't be the last.

## Why Security Is a Problem For Smart Cities

The rise of smart cities is intimately linked to the rise in production of Internet of Things (IoT) devices—as are its inherent security problems.

Your average IoT device is relatively cheaply produced. It's not built with the kind of security features you get on a Mac or Windows laptop or tablet or in a mobile phone. It is, however, connected to the internet.

These three factors have made IoT devices incredibly fertile cybercrime targets over the last decade or so.

In 2015, millions of children's names, genders, ages, photos, and parents' records (including home addresses) were compromised through a device known as the InnoTab—a kind of WiFi-enabled tablet for kids.

IoT devices are often trivially easy to access remotely because they're already connected to the internet and not built with cybersecurity in mind. Hackers don't even need to pull information from them. They can simply sit on the device and wait for it to gather information, or even requisition it for use in a distributed denial of service (DDoS) attack or botnet.

Cybersecurity researchers have found vulnerabilities in IoT devices in smart cities, too. Aside from the Dallas incident, significant issues have occurred in smart traffic signals and smart electricity meters. The number of attacks on infrastructure in the U.S. alone went from not even 200 in 2012 to 300 in 2015.

Today, advocates of smart cities are looking much more closely into the security of smart cities and how to build devices that can ensure our cities stay safe and protected—even as they get smarter. According to Gartner, 2.3 billion connected items were used in U.S cities throughout 2017. That number is only going to get bigger and bigger.

## Ensure Security For Critical Facilities

The most vulnerable locations in any smart city are the centers of utilities and power—power plants, water processing plants, and so on.

In Kiev in 2016, hackers shut down 20% of the city's power by hacking into an electrical substation.

Penetration testing is a common method that cities and municipalities use to test for vulnerabilities with their utilities. A security firm is hired to attempt to break in and gain access to the system. Afterward, they produce a report with their findings and give [recommendations for how to avoid the a real attack](https://www.redteamsecure.com/business-insider-rides-shotgun-as-redteam-security-hacks-the-power-grid/).

![Smart city -  crime of person gaining access to a facility](https://images.ctfassets.net/23aumh6u8s0i/1n7pLxG3VH1QfPNkEFt9TX/44b26808a6ffb50c7d924a0e3d40ad18/gaining-physical-access-to-facility)

Pen testing isn't just about lurking around a facility late at night and trying to gain physical access. It might also mean dropping a USB key, loaded with a virus, in the parking lot to see whether an employee happens to pick it up and stick it in their laptop; if they do, the key can be formatted to sit on the device as a keylogger, attempt to gain remote access, or send out phishing emails.

It's about social engineering—still one of the most effective ways of gaining access anywhere.

And it means, of course, more straightforward network and application penetration testing—trying to get in by remotely compromising the system itself.

## Two-Factor Authentication

Facilities that provide critical utilities, such as power and water, need to be made absolutely secure, but so does other essential infrastructure in smart cities—like subway transportation, street lights, and security cameras.

The essential technology of any smart city must employ cryptography to protect data. Otherwise, video feeds of your citizenry can wind up being streamed on the internet, or your street lights can end up flashing on and off for hours on end.

Data should be encrypted both at rest and in transit. Any systems that allow access from any parties must accept a username and a password and should go a step forward and enable two-factor authentication. Two-factor authentication is the easiest and most effective step you can take to prevent unauthorized access because it immediately cuts out the most obvious and available attack vectors.

![Two-factor authentication example using phone device auth to grant access](https://images.ctfassets.net/23aumh6u8s0i/HWYrg3Jdj6NOgoKwz1AgN/69deef407a90c08422882ec34e06392f/two-factor-authentication-using-smartphone)

[Two-factor authentication](https://auth0.com/learn/two-factor-authentication/), at root, is about ensuring that anyone accessing your systems has two methods of proving their identity. That might mean a username, password, and something like a biometric key or a one-time password delivered through an app on their phone, like [Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian) or Google Authenticator.

## Education For Citizens and Leaders

Ultimately, the best way to prevent most cyberattacks (on cities or anything else) from succeeding, or at least to mitigate the damages, is education.

Emails that look like they're from a C-suite executive at your company but have an odd-looking From: address, or USB drives that look like they've been forgotten in your office's parking lot: These are highly visible red flags that indicate that some person or group has gotten access to your systems or is trying to. They're also some of the most commonly successful attacks out there because many people don't recognize the signs for what they are.

When one person falls for a phishing email, it can cause huge ripple effects down the line as their contacts are emailed en masse and compromised as well.

Educating denizens about the common forms of cyberattacks and the ways to prevent falling victim to them is the number one way that cities—if they cannot prevent attacks from happening—can ensure that the effects of malicious acts do not ripple out and cause wider damage.

## The Future of Urban Cybersecurity

The cybersecurity challenges of the future are going to look bigger and much different than many of those we have today.

As smart devices proliferate and security vulnerabilities loom larger and larger, it's on all of us to make sure that the cities we are building—no matter how smart—are secure as well.

<include src="asides/AboutAuth0" />


How Do Smart Cities Tackle Cybersecurity?

Let’s cover the top 10 cybersecurity takeaways of my social engineering training at Black Hat.



I took the ["Achieving Security Awareness Through Social Engineering Attacks"](https://www.blackhat.com/us-18/training/achieving-security-awareness-through-social-engineering-attacks.html) course at [Black Hat this year](https://www.blackhat.com/us-18/)!

<br />
<div style="display: flex; justify-content: center;">
  <blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">“Achieving Security Awareness Through Social Engineering Attacks” <a href="https://twitter.com/hashtag/BHUSA?src=hash&amp;ref_src=twsrc%5Etfw">#BHUSA</a> Training taught by <a href="https://twitter.com/jaysonstreet?ref_src=twsrc%5Etfw">@jaysonstreet</a> &amp; <a href="https://twitter.com/aprilwright?ref_src=twsrc%5Etfw">@aprilwright</a> will use current Red Team strategies to develop a better understanding of how attackers use SE <a href="https://t.co/yuojeClInS">https://t.co/yuojeClInS</a></p>&mdash; Black Hat (@BlackHatEvents) <a href="https://twitter.com/BlackHatEvents/status/1002976909268045827?ref_src=twsrc%5Etfw">June 2, 2018</a></blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div>
<br />

It was eye-opening, tremendously interesting, and fun! It was facilitated by [Jayson Street](https://twitter.com/jaysonstreet) and [April Wright](https://twitter.com/aprilwright). Jayson gets paid by companies to break into their own facilities through [Social Engineering](<https://en.wikipedia.org/wiki/Social_engineering_(security)>). He shared many amazing stories, like the time he [gained full access to a bank in Beirut in two and a half minutes](https://www.youtube.com/watch?v=UpX70KxGiVo&feature=youtu.be&t=434).

![Corgi dog meme, coding on computer](https://images.ctfassets.net/23aumh6u8s0i/60r47IT9a84TsaSpyvHB4h/1f15d9303d87cc13b35de378f41ae7fc/corgi-social-engineering-meme)

[Source](https://imgflip.com/meme/38390688/corgi-hacker?sort=latest)

Here’s a summary of what we discussed in the training, along with key takeaways:

## OSINT and Social Media

> “Information doesn’t have to be secret to the valuable” ~ CIA

One of the key elements of Social Engineering is [Open-source Intelligence (OSINT)](https://en.wikipedia.org/wiki/Open-source_intelligence), which is insight produced from data collected from publicly available sources. **If you don’t have proper privacy settings in your social media accounts, the information you put there is public**.

In class, we discussed the case of a guy named Travis who put pictures of his badge, passport, plane tickets, job title, workplace and even emails on Instagram.

We analyzed how someone that overposts on social media could be targeted, and it’s not a surprise that it’s relatively simple. We also talked about tools and techniques to get and find relevant information.

There was an exercise about drafting (not sending) a spear phishing email in 1 hour targeted at someone in our organization using OSINT. Nobody used their own workplace and nobody said where they worked, but we completed the task with good results.

**Takeaway #1:** Review your privacy settings and don’t post private information on social media.

<include src="TweetQuote" quoteText="Review your privacy settings and don’t post private information on social media. Open-source Intelligence tools could be used to mine your data and create phishing opportunities."/>

## WiFi Pineapple and Bash Bunny

As part of the training, they gave us [some interesting gadgets from Hak5](https://www.hak5.org/) including a [WiFi Pineapple](https://www.wifipineapple.com/) and a [Bash Bunny](https://wiki.bashbunny.com/#!index.md). They are tools meant to be used for penetration tests, and they have many pranks that can help with Security Awareness programs by showcasing their associated dangers in safe and controlled setups.

> We also got a [Packet Squirrel](https://www.hak5.org/gear/packet-squirrel) as an extra gift!

### WiFi Pineapple

The WiFi Pineapple is a [Wireless Auditing tool](https://www.tutorialspoint.com/wireless_security/wireless_security_tools.htm) that can work as a [Man-in-the-middle platform](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). Among others, it allows the owner to intercept an open WiFi connection and inspect and modify HTTP traffic, redirect the user to a malicious site, or associate with past public WiFi connections and “pretend” to be one of them.

For example, if you’re near a Pineapple while your phone has WiFi turned on and is actively looking for connections, all of the sudden you may connect to the airport network you used 6 months ago and a site may ask you to pay for the service. They mention it on the [Silicon Valley TV Show](https://www.youtube.com/watch?v=9FckHMPBs_Q).

This is the picture of a WiFi Pineapple Tower because… Black Hat.

![WiFi Pineapple Tower at Black Hat Conference](https://images.ctfassets.net/23aumh6u8s0i/JCZHfzvkgBGa4Hp35EuBW/787cc9176b637d4189bab7e9d312a068/wifi-pineapple-tower)

**Takeaway #2:** Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it.

<include src="TweetQuote" quoteText="Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it."/>

### Bash Bunny

The Bash Bunny is a USB attack platform that can emulate trusted USB devices like Gigabit Ethernet, serial, flash storage and keyboards.

![Bash Bunny USB platform.](https://images.ctfassets.net/23aumh6u8s0i/2NNQP0gnYiYvYEEFuaHUsc/a78cb5ae090bb73827007b4051f99f01/bash-bunny)

We did a couple of experiments in the class: First, we used a “prank” payload that [rickrolls](https://en.wikipedia.org/wiki/Rickrolling) the target at a specific date and time. It took less than 20 seconds to deliver this payload.

Then we tested a “recon” payload and we could get the full terminal history, clipboard content, system users, [`ifconfig`](https://en.wikipedia.org/wiki/Ifconfig), WAN IP, and all installed applications. This took a little bit longer, but it was still fast and the computer was in sleep mode.

**Takeaway #3:** Don’t plug in random USB drives and be cautious when working on public spaces.

<include src="TweetQuote" quoteText="Don’t plug in random USB drives and be cautious when working on public spaces."/>

## Conclusion and Other Takeaways

We talked about other topics such as policies, security awareness programs, memes and the importance of repetition during training. These are the top 10 Takeaways of the experience:

1.  Review your privacy settings and don’t post private information on social media.

2.  Avoid open or public networks as much as possible, especially in crowded spaces. If you’re not in a trusted space, turn on WiFi only when you really need it.

3.  Don’t plug in random USB drives and be cautious when working on public spaces.

4.  Clickbait is widely used in social engineering, don’t trust it.

5.  Before running phishing campaigns, there should be policies and formal training in place.

6.  Although potentially controversial, hard to spot spear phishing emails create a more impactful “teachable moment” (as Jayson says).

7.  Certain topics of Security Awareness training should be tailored by role. An organization should have a site that groups all this information and internal security-focused newsletters could be useful as well.

8.  Controlled live demos with tools like the WiFi Pineapple and the Bash Bunny help raise security awareness.

9.  Prizes and gamification support these efforts.

10. It is important to always explain the purpose of the training, demo or campaign. We don’t ever want you to fail, we want to empower you and help make you one of our strongest lines of defense:

![Security training at Black Hat Conference](https://images.ctfassets.net/23aumh6u8s0i/386zANR8fvarMMfbzH9Mfg/5e492f230e1d8b29414d4eb3798ba793/teammate-empowerment)

<include src="TweetQuote" quoteText="Security training and awareness campaigns make people the best line of cybersecurity defense"/>

<include src="asides/AboutAuth0" />


Black Hat Training: Achieving Security Awareness Through Social Engineering Attacks

Information and tools to help you mitigate risk against cyber attacks and data breaches. Learn more about Malware Infiltration, Phishing, USB Traps, and Mobile Attacks.



In 2017, nearly [_179 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. It's clear that cyber criminals are growing more creative with how they gain access to networks and valuable data.

Many of today’s most common cyberattacks have been socially engineered to rely on human error. Even your best employees can become your greatest weakness if they open a suspicious email, click on a malicious link, or pick up and use an anonymous USB device.

There are ways to protect your organization against sensitive data breaches. Here are four of the most common cyberattack examples and the ways you can avoid them.

## **1. Malware Infiltration**

**What makes you vulnerable: outdated software and lack of backup protocols**

Malware is a term that encompasses many different types of malicious software, including ransomware and spyware. Each type of malware can wreak havoc once it gains access to a system.

WannaCry, for example, a form of ransomware, recently [took advantage of a weak spot in Microsoft’s operating system](https://www.symantec.com/security-center/writeup/2017-051310-3522-99). Banks, health care providers, manufacturers, and other businesses across the globe reported WannaCry's encryption.

![WannaCry encryption](https://images.ctfassets.net/23aumh6u8s0i/1vTw3WKZIs3Fs1RZGhNNeI/18d3869c4068bf29ce62e9ce8eb6e9db/WannaCry-encryption)
  
[[Source](https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/)]

In order to regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [_bitcoin_](https://bitcoin.org/en/). [_Sixteen National Health Service’s offices_](https://developers.redhat.com/blog/2017/05/19/wannacry-ransomware-who-it-affected-and-why-it-matters/) and over 200,000 PCs worldwide reported this.

_Solution: Regularly updating your systems will go a long way toward removing dangerous holes. It's a simple fix that many teams, including [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/), have neglected._

_If you want added security, consider [moving to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/). Not only will this allow your enterprise more flexibility to scale, but you can also delegate specialized security tasks like IAM and encryption to expert providers._

## **2. Phishing **

**What makes you vulnerable: lack of education and attention to detail in suspicious e-mails**

In 2016, [91% of cyberattacks](https://phishme.com/2016-enterprise-phishing-susceptibility-report/) were the result of a spear-phishing email. Phishing e-mails steal data either by tricking recipients into giving it to the cyber criminals or by getting users to download a file that installs spyware—software designed to steal information directly from a user’s device.

Children’s Mercy Hospital [_recently reported a breach_](https://healthitsecurity.com/news/childrens-mercy-hospital-phishing-attack-impacts-phi-of-60k) that exposed the health care information of at least 60,000 people. E-mails tricked users into disclosing their work e-mail credentials, which led to the exposure of patient health data when the hackers gained access to the inboxes of the targeted hospital workers. Children’s Mercy [_is now being sued_](https://www.hipaajournal.com/childrens-mercy-hospital-sued-for-63000-record-data-breach/) for this major breach.

Here’s an example of an imitation Dropbox e-mail asking for confirmation of a user’s e-mail:

![Imitation Dropbox email phishing scam asking for confirmation of a user’s e-mail](https://images.ctfassets.net/23aumh6u8s0i/7jVF95LDb067AOrODuA8SI/2fb640b69a3567e208636c1abad55fc1/dropbox-email-asking-confirmation-of-user-email)

[_Source_](https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250)

When users click the “Verify your email” link, spyware software is automatically downloaded onto the users' computers.

_Solution: As these e-mails start to look more realistic, it’s important to educate employees on how to spot a questionable e-mail chain._

_Creative training programs include the following:_

- _Digital Defense's [SecurED training program](https://www.digitaldefense.com/professional-services/secured-training/) that works with award-winning Hollywood comedy writers_
- _Terranova's [customizable newsletters](https://terranovacorporation.com/solution/communication-material/)_
- _Inspired eLearning's [Security Awareness for the C-Suite](https://inspiredelearning.com/security-awareness/awareness-c-suite/)_
- _Wombat Security's [everyday tips](https://www.wombatsecurity.com/security-education/free-security-awareness-resources)_

_[See here for a larger list.](https://www.csoonline.com/article/3225471/security/please-dont-send-me-to-cybersecurity-training.html)_

## **3. USB Traps**

**What makes you vulnerable: lack of education and policy on outside device use **

Hackers who want a direct route to company data often use a hardware device, such as a USB drive. A [_recent Google study_](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/45597.pdf) revealed that at least 45% of people who find a USB drive will plug it into their computers. Planted USB drives may contain malware or a link that requests information, similar to a phishing e-mail.

The worst-case scenario is a drive that contains a HID spoof. This is where the USB drive tricks the computer into believing the drive is actually a keyboard and then issues a set of keystrokes that forces the computer to dump data back to the hacker. It can also allow them access to whatever network the computer is connected to.

![HID spoof process](https://images.ctfassets.net/23aumh6u8s0i/6tgD3dKhZRBiDXExHQw0H3/b36a8b23e6518b6d0c93f44e0e0f69f3/hid-spoof-process)

_Solution: Outlawing anonymous, external drives on company devices will send a clear message to your organization. Whether a drive was planted or simply purchased from an illegitimate source, removing the temptation to plug something in without properly vetting is a low-hanging fruit that can have enormous power to secure your team and your end users._

## **4. Mobile Attacks**

**What makes you vulnerable: employees accessing company data and networks via cell phones**

Hackers are well aware of the explosion of smartphone and tablet use and have created attacks specifically designed for mobile software. [_The Pegasus attack_](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message.

<p style="text-align: center;">
  <img style="width: 300px;" src="https://images.ctfassets.net/23aumh6u8s0i/1ii40f6m9VQ1rBmWpgY1pF/de53a4b3444b16e607d52ee34bb9933e/pegasus-mobile-attack-on-ios" alt="Example of Pegasus attack on Apple iOS mobile software."/>
</p>

[_Source_](https://www.hax4us.com/2017/03/hindi-english-smishing-brother-of.html)

Phishing text messages are composed to look legitimate, just as phishing e-mails are. With Pegasus, clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. The software also copied all of their calendar, contact, and e-mail data.

Pegasus was an especially frightening cyberattack because it took advantage of [_“zero day” vulnerabilities_](https://www.huffingtonpost.co.uk/entry/what-is-the-pegasus-iphone-spyware-and-why-was-it-so-dangerous_uk_57c0043fe4b0ba22a4d3f930?guccounter=1), meaning there wasn’t any prior knowledge of the vulnerabilities in Apple’s iOS until Pegasus struck. Once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

_Solution: If a mobile phone or tablet has been breached, you need a Plan B. Make sure employees quickly change their passwords by using a professional password manager, such as [LastPass](https://www.lastpass.com/) or [Valt](https://valt.io/). Many employees secure critical information with easy-to-guess iterations of a single password. Encouraging length and complexity in all passwords going forward will make it difficult for hackers to access multiple areas at once._

## Additional Security for All Systems at the Login Stage

Good password policy and sound employee education are key; however, taking the next step with [secure login procedures](https://auth0.com/b2c-customer-identity-management) will add a new dimension of safety to your system. Specialized identity solutions providers can offer support with [multifactor authentication](https://auth0.com/docs/multifactor-authentication).

Tracking your users from the start will help eliminate fraud at its origin, helping provide a secure foundation to allow your team to scale.

<include src="asides/AboutAuth0" />


Four Cybersecurity Attacks Your Employees Need to Know

joan-pepin

As CSO, Joan is responsible for the holistic security and compliance of Auth0's platform, products, and corporate environment. She brings 20 years of experience to the role, with a career that has spanned a wide variety of industries, including healthcare, manufacturing, defense, ISPs, and MSSPs. <br /><br />Previously, Joan served as Business Information Security Officer (BISO) at Nike, Inc, CISO, and VP of Security at Sumo Logic, and held different positions at Guardent/Verisign/Secureworks organization. Joan holds a patent for developing the methodology to assess whether a communication contains an attack. <br /><br />She is also is a well-recognized thought leader and has spoken at major events, such as RSA, WhiteHat Security Summit, and Forrester Security Summit, and is frequently called upon for her expertise and commentary in Cloud Security and Compliance in large-scale and DevOps/CI environments.

Chief Security Officer (CSO)

Joan Pepin

A security researcher claimed that an attacker could perpetrate a phishing scam that could target a company using the Auth0 platform based on domain. Learn about this attack, the prevalence of phishing in the industry, and how to mitigate these scams.



A security researcher working for another company recently published a blog post stating that they could potentially perpetrate a phishing attack targeting users of a website that uses Auth0 authentication. Note that phishing is not the same as hacking a code vulnerability, and therefore, no software patches can be applied because no flaw exists in Auth0's system. Let’s explore the mechanism behind this theoretical phishing attack, the prevalence of social engineering scams in today’s tech industry, and what companies and their users can do to better protect themselves.

## What is Phishing?

[Phishing](https://www.csoonline.com/article/2117843/phishing/what-is-phishing-how-this-cyber-attack-works-and-how-to-prevent-it.html) is a type of social engineering cyber attack that has been around since the 1990s and is still extremely prevalent today. Phishing typically begins with email. Emails are sent to target individuals, and these emails contain links or attachments that have malicious intent: either to install malware on the user’s device, or get them to enter sensitive data into a website that masquerades as legitimate.

Phishing attacks are [growing increasingly sophisticated](https://www.menlosecurity.com/blog/from-your-account-is-deactivated-to-oauth-the-evolution-of-phishing) in the modern landscape of the internet, and the intent is to deceive people into providing protected information, often credentials. Regardless of sophistication, however, the premise of phishing is still very straightforward.

Consider this sequence of events, for example:

1. A user of Service A (`service-a.com`) is sent an email that appears to be from Service A. The email tells the user they need to log in using a link in the email.
2. The user clicks on the link, which takes them to a login page at `malicious-service-a.com` (_not_ the real website at `service-a.com`).
3. The page has been styled to look like a legitimate page from Service A, so the user enters their credentials into the login form.
4. The credentials have then been given to the attacker, who can now access the real Service A with the victim’s stolen login information. In addition, due to the common practice of [password reuse](https://www.troyhunt.com/password-reuse-credential-stuffing-and-another-1-billion-records-in-have-i-been-pwned/), the attacker may even have access to other accounts that the victim holds on other sites.

This is just one possible example of a phishing scam flow. The attacker could just as easily ask for other kinds of personal information, or request that the user download a malicious email attachment.

## Phishing with Auth0 Subdomains

The specific idea behind the security researcher’s phishing scam was a way to target a website that uses Auth0 authentication. Auth0 supports regional subdomains: `auth0.com`, `eu.auth0.com`, and `au.auth0.com`. A bad actor could potentially attempt to scam users of a website or application that uses one of the subdomains by registering any of the other regional subdomains while using the same name. The attacker could then set up a custom page on their subdomain and, _assuming that they had access to the email addresses of users_, send them a link and attempt to solicit secure information from them. Similar scams could be attempted using _any_ domain that users could mistake for a legitimate one.

<a href="https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)">Cross-Site Scripting, or XSS</a>, was not used in the exploration of a phishing attack that could use Auth0 regional subdomains to trick users. [XSS describes the injection of malicious scripts into a vulnerable web application](https://www.incapsula.com/web-application-security/cross-site-scripting-xss-attacks.html). This exploration relied on using a custom Auth0 page in a subdomain in another region, but [no malicious cross-site code could be injected](https://auth0.com/docs/hosted-pages#why-use-hosted-pages). The ability to include JavaScript in custom pages is a feature available to Auth0 customers to enable necessary flexibility. However, _cross-site code_ cannot be executed from these pages.

## This Attack is Not New and Not Unique

As stated previously, phishing attacks have been around for decades: almost thirty years, in fact. They have become more sophisticated and insidious in their execution, but they rely on tricking people into divulging confidential information: these kinds of attacks are referred to as <a href="https://en.wikipedia.org/wiki/Social_engineering_(security)">social engineering</a>. In these scams, it is common for malicious actors to use domains that look very similar to the target domain to make their phishing attempt more convincing. This is still true now, as well as historically.

> "It's unclear why the researcher used Auth0 as a common example of phishing targeting Auth0. There are no vulnerabilities here and their research doesn't show anything new. It is simply another example of possible phishing. The same could be done with the `anycompany.com` website by using a look alike domain and then setting up a login page same as this one `https://www.anycompamy.com/Login`."
>
> –Cesar Cerrudo, globally recognized security expert and CTO at [IOActive Labs](https://ioactive.com/)

**No company that has users with email addresses is impervious to phishing scams.** There are thousands of ways to perpetrate the [same kind of phishing attempt](https://auth0.com/blog/all-you-need-to-know-about-the-google-docs-phishing-attack/) [on any company](https://www.justice.gov/usao-sdny/pr/lithuanian-man-arrested-theft-over-100-million-fraudulent-email-compromise-scheme), aside from Auth0, [making the attacks quite prevalent](https://www.tripwire.com/state-of-security/security-data-protection/three-quarters-organizations-experienced-phishing-attacks-2017-report-uncovers/) in the tech industry.

## Phishing Relies on Tricking Users

[Phishing is not the same as hacking a code vulnerability](https://blog.varonis.com/whats-difference-hacking-phishing/), and therefore, no software patches can be applied because no flaw exists in Auth0’s system. The particular phishing attack described by the security researcher is not being actively used. Auth0 provides security measures to help prevent credential harvesting via phishing, such as [Single Sign-On](https://auth0.com/docs/sso/current), [Multifactor Authentication](https://auth0.com/learn/get-started-with-mfa/), and [Passwordless](https://auth0.com/passwordless). In addition, [Breached Password Protection](https://auth0.com/breached-passwords), [Brute Force Protection](https://auth0.com/docs/anomaly-detection#brute-force-protection), and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) can help mitigate the potential outcomes of phishing attacks. Auth0 also supports the use of [Custom Domains](https://auth0.com/docs/custom-domains), which removes `auth0.com` (or regional `auth0.com` subdomains) from your application and replaces with a domain of your choosing, which completely eliminates the ability of an attacker to perform this scam using Auth0 subdomains.

However, it is important to remember that **phishing scams are quite common and easy to execute if an attacker already has your users’ email addresses**. Although using an Auth0 Custom Domain or registering all regional Auth0 subdomains eliminates the attack avenue described in this specific case, an attacker could still register any other Top Level Domain name that is similar to yours and attempt to deceive your users. For example, if your company’s login domain is `login.real-company.com`, a phishing attack could be perpetrated from a similar domain, such as `login.rea1-company.com`. In addition, a bad actor could just as easily send a malicious email attachment to your users instead.

## Protecting Your Company and Users

The safety of companies and their users should be the paramount concern when discovering and sharing information regarding security. Not committing to thorough research can negatively impact customers, users, and the general technology community.

Any company implementing authentication of any kind — proprietary or using an Identity and Access Management platform such as Auth0 — should have security practices in place to mitigate phishing attacks. These practices should include regular internal anti-phishing campaigns and training, as well as Multifactor Authentication or Passwordless. Monitoring for lookalike domain names is also recommended. With the proliferation and increasing cleverness of phishing scams, the importance of awareness and training cannot be understated.

Phishing Attacks with Auth0? Facts First

Here are 5 trends that will help you keep your organization secure in 2018.


<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>GDPR is around the corner. Are you Ready? Take our GDPR Readiness Assessment to find out. <a href="https://auth0.com/gdpr-assessment/tool-1">Start the survey</a>.</strong>
</div>

---

**TL;DR:**  It's easy to predict the security threat for 2018 (Hint: It will be bigger and more sophisticated than 2017). It's another thing to prepare for what lies ahead. Here are 5 trends that will help you keep your organization secure in 2018.

<include src="TweetQuote" quoteText="Here are 5 trends that will help you keep your organization secure in 2018"/>

[GDPR compliance](https://auth0.com/gdpr) is dominating the 2018 security discussion. With the May 25th deadline quickly approaching, the first half of 2018 will likely be consumed with making the necessary changes for compliance, which is an enormous task for any size company.

While GDPR is extremely important and failure to comply comes with [stiff penalties](https://resources.auth0.com/whitepaper/gdpr-fine-determination/), don't let it distract you from anticipating the security threats that await your organization. If you thought 2017 was a massive year of cyber attacks, there are unfortunately no signs of slowing down in 2018.

Here are our 5 security predictions to help you prepare for 2018.

### 1. Customers Are Fed Up With Passwords

The weaknesses of traditional credentials are well documented, yet most organizations continue to use them as the primary security method. Customers have had enough.

The Equifax breach was the straw that broke the camel's back. While security experts have known of the vulnerabilities of password reliance, the high-profile breaches of 2017 have brought a higher level of awareness to the general public.

People want security alternatives. A recent [survey](https://www.csoonline.com/article/3242866/security/our-top-7-cyber-security-predictions-for-2018.html) showed that people are now more concerned with someone stealing their personal data than they are with a home break-in. A company's reluctance to add stronger authentication will have to deal with fierce customer demand for additional security beyond the password.

The first logical step to strengthening traditional credentials is to implement [multifactor authentication](https://auth0.com/docs/multifactor-authentication) (MFA).

![Multi-factor Auth](https://images.ctfassets.net/23aumh6u8s0i/4n9ZcXraMMRDtcmRwG04bn/5aee12138b7dee3679d1ec18cdb246e4/Multifactor-Authentication)

MFA is a method used to verify a user's identity when they are trying to access an application. In addition to a password, MFA requires you to provide additional information such as an SMS code or a fingerprint to confirm your identity.

Consumer-oriented companies like Google, Apple, and PayPal have made MFA a standard feature and the trend will continue in 2018 with both consumer and enterprise accounts.

### 2. Preventing Aftershock Breaches

Companies that are breathing a sigh of relief that they weren't hit by a cyber attack in 2017 need to worry about a different type of threat — the aftershock breach.

The millions of compromised credentials taken from previous breaches now pose a liability for every company that uses passwords for security (which is everyone). Most people use the same credentials for all of their accounts, which heightens this risk of an aftershock breach, where hackers use the stolen credentials to access other accounts.

Experian's recent Data Breach [Report](https://www.experian.com/assets/data-breach/white-papers/2017-experian-data-breach-industry-forecast.pdf) notes:

> Given the continued success of aftershock breaches involving username and passwords, we predict that attackers are going to take the same approach with other types of attacks involving even more personal information, such as social security numbers or medical information.

Aftershock breaches can be minimized by using risk-based authentication, such as[ anomaly detection](https://auth0.com/docs/anomaly-detection) which monitors user behavior data to determine suspicious activity. By[ collecting signals](https://auth0.com/university/1/4/how-to-use-auth0-s-rules-feature) such as an IP address or the location of a user, anomaly detection can compare previously established behavior in order to spot inconsistencies.

![Password Breach Block](https://images.ctfassets.net/23aumh6u8s0i/3UQfTsXEnWW38EvMxQ7VvM/881ab7f175259a79750d7aafd6837fd3/breached-pass-lock)

Auth0's anomaly detection also tracks [password breaches](https://auth0.com/breached-passwords) of major third-party sites to help keep your users and systems secure. When a company like Equifax is breached, you can block your users from logging into your accounts until they go through a new authentication protocol.

When combined with MFA, anomaly detection makes it really hard for hackers to leverage their stolen credentials and initiate an aftershock breach.

### 3. Weaponizing Data Rather Than Stealing It

A few years ago, someone hacked into the Associated Press' Twitter account and tweeted a false report that President Obama had been injured in an explosion. The news caused a 150-point drop in the stock market.

![Source](https://images.ctfassets.net/23aumh6u8s0i/4Z7i4HQDeGCtb9UE1oVoKg/edc28deb72bca4907cd0af23e55c8b53/67201644_ap)

This type of data manipulation, known as a data integrity attack, will become more prevalent in 2018. While stealing millions of credit card numbers might seem like a huge score, it only works if you have a buyer on the other end. Hackers are realizing that it is much easier to capitalize on the data itself.

For example, an attacker could doctor a bank's routing numbers for a large financial gain. Or, one could erode public confidence by shutting down electrical grids. Regardless of the intention, the new target is in using the data, not stealing it.

Integrity attacks are hard to detect, which could leave companies defenseless with their current monitoring systems. The immediate solution to this threat is [data encryption](https://digitalguardian.com/blog/what-data-encryption). Most companies have an encryption policy that protects their most sensitive data, but the definition of sensitive data must be expanded to protect all potential attacks.

![Source](https://images.ctfassets.net/23aumh6u8s0i/1L5kShBmyTcdpOSeANibPA/161401f1ab2aa62f9563ce6668e6cabd/data-encryption)

The idea behind data encryption is to make your data incoherent to outsiders without the decryption key. **Why does this matter?**

The breaches in the past five years have shown that hackers can infiltrate the most sophisticated cyber security systems in the world. Traditional security like firewalls, intrusion monitoring and antivirus software are not very effective once hackers get inside. The last line of defense is to encrypt your data.

### 4. Rise of the Bots Against IoT

Bots are supposed to be our friends. They take care of the tedious, repetitive tasks so we can focus on the more important work. **But what happens when bots turn to the dark side?**

In 2016, a [botnet](https://www.csoonline.com/article/3240364/hacking/what-is-a-botnet-and-why-they-arent-going-away-anytime-soon.html) of more than 500,000 devices [attacked ](https://en.wikipedia.org/wiki/2016_Dyn_cyberattack) Dyn, a domain name service providers, crippling the internet and impacting huge websites like Amazon, Spotify, and Netflix. These types of attacks are often executed through internet-connected devices, and the threat for 2018 has never been greater.

![Source](https://images.ctfassets.net/23aumh6u8s0i/2XSmrlVo479am1wBxhs8PQ/b6429c8a47e75c0c1c6dc646fde06a9c/botnet2_1238990)

IoT is expected to surpass 10 billion devices in 2018 and over [22 billion by 2021](http://uk.businessinsider.com/the-internet-of-things-2017-report-2017-1?r=DE&IR=T). Every one of these devices poses a security risk as the surface area for an attack expands well beyond what current security measures can handle. In fact, [HP](http://www8.hp.com/de/de/hp-news/press-release.html?id=1744676#.WMFmT1XyiUk) found that at least 70 percent of IoT devices are vulnerable to an attack.

Hackers can simply buy a botnet kit, which gives them everything they need to launch an attack. The three most popular kits—Andromeda, Gamarue, and Wauchos—have already helped attackers infiltrate millions of devices. Once inside, the bots are capable of a myriad of debilitating tasks from taking down networks to compromising data or even controlling a device. **It will make you think twice about who is driving your self-driving car.**

### 5. Phishing is Still King

Major data breaches, ransomware attacks, and identity theft often start the same way—with a simple phishing scheme.

Phishing is still the most effective method for attackers to infiltrate a system, mainly because it relies on human error, which renders technical security useless. The only real defense is to train people to identify schemes and remain aware at all times.

While awareness will help prevent traditional phishing, attackers are creating more sophisticated techniques to outsmart the uneducated. They've also found success with other channels beyond email like phishing with SMS, also known as smishing.

![https://images.ctfassets.net/23aumh6u8s0i/6CsaSx8Zo8BWwel3zXoo5V/e4e81b69fc9360fd19c5471d3d439482/phishing-bank](https://images.ctfassets.net/23aumh6u8s0i/6CsaSx8Zo8BWwel3zXoo5V/e4e81b69fc9360fd19c5471d3d439482/phishing-bank)

Smishing scams are harder to detect because they take advantage of people's sense of urgency. Let's say you receive a text that appears to be an important message from your credit card company. An urgent message can catch you off guard and before you know it, you've compromised your information.

Awareness training becomes more difficult with smishing because of its heightened nature. You can't always prevent someone from being tricked by phishing, but you can anticipate it and secure your accounts beyond credentials. Password managers like [1Password](https://1password.com/) can be useful, but adding more layers of defense with MFA will help keep your accounts safe.

## Security in 2018 is About Proactive Prevention

Sadly, many of the breaches in 2017 could have been prevented with stronger security measures, especially around identity access management. Archaic methods like passwords and unprotected data made it easy for hackers to pull off some of the biggest heists of 2017 including corporate giants like Equifax and Deloitte.

The attack tactics might evolve, but at the end of the day, taking proactive measures will help deter the majority of attempts. By understanding the different threats, you can get ahead of them before they occur.

**_READ MORE:_**  [How Poor Identity Access Management Equals Security Breaches](https://auth0.com/blog/how-poor-identity-access-management-equals-security-breaches/)


Security Predictions for 2018 That Go Beyond GDPR Compliance

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Former Auth0 Employee

Prosper Otemuyiwa

Learn how the Google Docs Phishing Scam was perpetrated and how it could have been avoided.



Two days ago, there was a large phishing scam that plagued the internet. It was a *Google Doc* phishing attack perpetrated via Gmail. On Wednesday, a worm in the form of an email arrived in a lot of Gmail users' inboxes from contacts they knew. The email stated that a Google Doc document had been shared with them.

![Email claiming a document had been shared](https://images.ctfassets.net/23aumh6u8s0i/5uEW1PGYAvahiyNqUjRSSm/a75b3e82bce4c1f4cfc4b9c8cba8c402/sharedwithme)
_Email claiming a document had been shared_

If the user clicked the link to open the document, it immediately redirected the user to a Google account selection screen for authorization.

![Google Account Selection Screen](https://images.ctfassets.net/23aumh6u8s0i/5Ol9BqIjG1bSPKj9xzWxnx/7cafc80089ebf67644ee0b9c6ac3a3e9/googleaccountselection)
_Google Account Selection Screen_

---

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr">Phishing (or malware) Google Doc links that appear to come from people you may know are going around. DELETE THE EMAIL. DON&#39;T CLICK. <a href="https://t.co/fSZcS7ljhu">pic.twitter.com/fSZcS7ljhu</a></p>&mdash; Zeynep Tufekci (@zeynep) <a href="https://twitter.com/zeynep/status/859840026082988038">May 3, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

If the user gave the fake app posing as *Google Docs* permission, it had the ability to *read*, *send*, *delete* and *manage* your email. It also had the ability to manage your accounts. These permissions allowed the worm to replicate itself by sending itself to all your contacts.

<blockquote class="twitter-tweet" data-lang="en"><p lang="en" dir="ltr"><a href="https://twitter.com/zeynep">@zeynep</a> Just got this as well. Super sophisticated. <a href="https://t.co/l6c1ljSFIX">pic.twitter.com/l6c1ljSFIX</a></p>&mdash; Zach Latta (@zachlatta) <a href="https://twitter.com/zachlatta/status/859843151757955072">May 3, 2017</a></blockquote>
<script async src="//platform.twitter.com/widgets.js" charset="utf-8"></script>

---

## Swift Combat Action From Google

Once Google got wind of this phishing scam, they swept into action by disabling the malicious accounts, removed fake pages and pushed updates through Safe Browsing to users within an hour. It is highly commendable that Google nipped it in the bud early enough.

![Google Action](https://images.ctfassets.net/23aumh6u8s0i/25aK7IDG3WM9iyJOrbhF4X/a292b1cfc25c8abf9230138c85ca834b/reddit)
_Googlers taking charge_

## What to Do if You Granted Permission

If you already gave the fake *Google Docs* app permission, here is how to protect yourself.

1. Head over to [https://myaccount.google.com/permissions](https://myaccount.google.com/permissions).
2. Find the app named **Google Docs**.
3. Revoke the permission by clicking the **Remove** button.

## How to Avoid Phishing Scams

Phishing scams have been around for a long time and they aren't going anywhere soon. Just last year, there was a case of a hacker who [stole nude pictures from celebrities](http://www.bbc.com/news/technology-36702837) via a phishing scam that targeted iCloud accounts.

Here are a few tips to help you avoid falling victim to these scams.

1. **Look out for fake and forged Sites:** Verify that the site is secure by ensuring that the URL starts with https:// instead of http. Look out for typos in the site name and URL.
2. **Install an anti-phishing toolbar:** You can install these toolbars on your Internet browsers. They check the sites that you are visiting and compares them to lists of known phishing sites.
3. **Beware of links and attachments in your emails:** Before you click on a link in your email, hover over it and check if the link actually links to a legitimate secure site. Don't click on links that appear in random emails and instant messages.
4. **Regularly update your browser**.
5. **Beware of pop ups**: Virtually all browsers allow you to block pop-ups, so you can set that as the default action. You can allow pop-ups sparingly when you actually need them.

## Aside: Implementing API Authorization with Auth0

This phishing attack took advantage of the OAuth protocol, a convenient way for internet accounts to link with third-party applications. Users don't have to hand over any password information. They just grant permission to a third party app.

One of the features Auth0 provides is [API Authentication and Authorization using the OAuth 2.0 authorization framework](https://auth0.com/docs/api-auth). Auth0's API authorization features allow you to manage the authorization requirements for server-to-server and client-to-server applications. If you want to use Auth0 authentication to authorize _API requests_, note that you'll need to use [a different flow depending on your use case](https://auth0.com/docs/api-auth/which-oauth-flow-to-use).

In addition, our *ODIC Conformant Authentication* pipeline allows you to create third-party clients for your APIs and display consent dialogs for authorization.

If a user is authenticating through a third-party client and is requesting authorization to access the user's information or perform some action at an API on their behalf, they will see a consent dialog like so:

![Consent Dialog](https://images.ctfassets.net/23aumh6u8s0i/2nVdix1kfZCLHjn6rFWvsp/79b2190997019e864014777ccfc5b7d9/consent-dialog)
_Consent Dialog_

If the user chooses to allow the application, this will create a user grant which represents this user's consent to this combination of client, resource server and scopes. The client application will then receive a successful authentication response from Auth0. However, if a user decides to reject consent to the application, they will be redirected to the `redirect_uri` specified in the request with an `access_denied` error like so:

```bash

HTTP/1.1 302 Found
Location: https://fabrikam.com/contoso_social#
    error=access_denied
    &state=...

```

> Auth0 provides the simplest and easiest to use [user interface tools to help administrators manage user identities](https://auth0.com/user-management) including password resets, creating and provisioning, blocking and deleting users.

## Conclusion

At Auth0, we are passionate about security. I hereby recommend this [personal information security identity guide for you, your friends and family](https://auth0.com/blog/personal-information-security-identity-guide). Take the time to go through this guide and protect yourself from cybercriminals and phishing scams.


"phishing"