Telecom
Attackers Exploit Stolen Session Cookies to Bypass Multi Factor Authentication and Gain Access to Corporate Resources – Sophos Report Reveals
Sophos, a global leader in next-generation cybersecurity, today announced in the Sophos X-Ops report, “Cookie stealing: the new perimeter bypass,” that active adversaries are increasingly exploiting stolen session cookies to bypass Multi-Factor Authentication (MFA) and gain access to corporate resources.
In some cases, the cookie theft itself is a highly targeted attack, with adversaries scraping cookie data from compromised systems within a network and using legitimate executable to disguise the malicious activity.
Once the attackers obtain access to corporate web-based and cloud resources using the cookies, they can use them for further exploitation such as business email compromise, social engineering to gain additional system access, and even modification of data or source code repositories.
“Over the past year, we’ve seen attackers increasingly turn to cookie theft to work around the growing adoption of MFA. Attackers are turning to new and improved versions of information stealing malware like Raccoon Stealer to simplify the process of obtaining authentication cookies, also known as access tokens,” said Sean Gallagher, principal threat researcher, Sophos. “If attackers have session cookies, they can move freely around a network, impersonating legitimate users.”
Session, or authentication, cookies are a particular type of cookie stored by a web browser when a user logs into web resources. If attackers obtain them, then they can conduct a “pass-the-cookie” attack whereby they inject the access token into a new web session, tricking the browser into believing it is the authenticated user and nullifying the need for authentication.
Since a token is also created and stored on a web browser when using MFA, this same attack can be used to bypass this additional layer of authentication.
Compounding the issue is that many legitimate web-based applications have long-lasting cookies that rarely or never expire; other cookies only expire if the user specifically logs out of the service.
Thanks to the malware-as-a-service industry, it’s getting easier for entry-level attackers to get involved in credential theft. For example, all they need to do is buy a copy of an information-stealing Trojan like Raccoon Stealer to collect data like passwords and cookies in bulk and then sell them on criminal marketplaces, including Genesis.
Other criminals on the attack chain, such as ransomware operators, can then buy this data and sift through it to leverage anything they deem useful for their attacks.
Conversely, in two of the recent incidents that Sophos investigated, attackers took a more targeted approach. In one case, the attackers spent months inside a target’s network gathering cookies from the Microsoft Edge browser.
The initial compromise occurred via an exploit kit, and then the attackers used a combination of Cobalt Strike and Meterpreter activity to abuse a legitimate compiler tool to scrape access tokens. In another case, the attackers used a legitimate Microsoft Visual Studio component to drop a malicious payload that scraped cookie files for a week.
“While historically we’ve seen bulk cookie theft, attackers are now taking a targeted and precise approach to cookie stealing. Because so much of the workplace has become web-based, there really is no end to the types of malicious activity attackers can carry out with stolen session cookies. They can tamper with cloud infrastructures, compromise business email, and convince other employees to download malware or even rewrite code for products. The only limitation is their own creativity,” said Gallagher.
“Complicating matters is that there is no easy fix. For example, services can shorten the lifespan of cookies, but that means users must re-authenticate more often, and, as attackers turn to legitimate applications to scrape cookies, companies need to combine malware detection with behavioral analysis.”
To learn more about session cookie theft and how adversaries are exploiting the technique to carry out malicious activity, read the full report, “Cookie Stealing: the new perimeter bypass,” on Sophos.com.
Telecom
NCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
Nigerian Communications Commission (NCC) is in talks with the Central Bank of Nigeria (CBN) over the Unstructured Supplementary Service Data (USSD) debt totalling N250 billion between the telecom operators and the commercial banks in the country.
USSD, known as quick or feature codes, is a global system for mobile communications (GSM) protocol used to send text messages and initiate financial transactions such as cash transfers, balance inquiries, payments for services and others.
However, the USSD platform, which is widely relied upon by millions of Nigerians for quick and efficient mobile transactions, has become a point of disagreement between the banks and telecom operators.
The crisis dates back to 2019 when telcos proposed charging N4.50 per 20 seconds of USSD usage in order to cover operational costs after years of providing the service for free.
But the banks kicked against this, saying a 450% increase in transaction costs will significantly grow the debt and strain relations between the two vital industries.
However, Dr Ikechukwu Adinde, director of Consumer Affairs Bureau, NCC, who disclosed this move, said commission was hopeful the issue would soon be settled.
According to him, “The NCC remains committed to ensuring that the interests of all stakeholders—consumers, telcos, and banks—are protected.”
He insisted that a resolution is critical to maintaining the seamless operation of mobile financial services that millions of Nigerians depend on daily.
Adinde, who also said plans are on to introduce reforms at enhancing tariff transparency in the telecommunications industry, believed the new move between the NCC and the CBN would put the debt issue finally to rest.
On transparency and responsibility policy, Adinde said the changes, set to roll out in the coming months, will require telecom operators to provide consumers with clear, easily accessible tables outlining tariff plans, billing rates, and the terms and conditions associated with their services.
Indeed, Karl Toriola, chief executive officer (CEO) of MTN Nigeria, had said in October that banks might be disconnected from the USSD platform due to debt arising from the use of the quick codes by their customers.
Toriola had said mobile network operators (MNOs) might, subject to regulatory approval, suspend use of the service on the network for banking operations, as the debt had continued to pile up and was becoming unsustainable to the operators.
Also, Gbolahan Awonuga, executive secretary of the Association of Licensed Telecommunication Operators of Nigeria (ALTON), said in October that the debt between telecoms operators and commercial had hit N250billion.
Earlier, the telcos had lamented that they could no longer provide the services free, proposing a cut of N4.50k per 20 seconds from the charges paid by customers to the banks.
But the banks kicked against this, adding that it would raise costs by 450 percent.
Credit: Daily Post
Telecom
9mobile CEO Highlights Key Solutions for Securing Electronic Money Transfers in Africa
Obafemi Banigbe, CEO of 9mobile, recently shared his expertise at the Alliance for Innovative Regulation (AIR) virtual conference, tackling the pressing issue of digital payment fraud in West Africa.
His insightful perspectives offered valuable insights into combating identity theft, a major threat to electronic money transfer security across the African continent.
Speaking as a panellist in a session moderated by Nick Cook, Chief Innovation Officer at AIR, Banigbe outlined how telcos play a pivotal role in protecting financial transactions.
“Fraud is fundamentally a human challenge, not just a technological one,” he remarked, emphasising that identity theft remains central to electronic money transfer fraud and requires a community-driven, human-centred approach.
He emphasized the critical role of telecommunications companies as guardians of security in the financial ecosystem. He outlined the proactive measures 9mobile and other telcos are taking to fortify financial systems, focusing on several key areas.
Banigbe highlighted the integration of Know Your Customer (KYC) systems, which leverage collaborations with national ID databases, banking records, and mobile number registries to enhance customer verification.
He also stressed the importance of robust security tools, including SIM registration, Biometric authentication (fingerprint and facial recognition) and One-Time Password (OTP)-based authentication. These measures he said collectively strengthen verification processes, ensuring a more secure financial ecosystem.
Banigbe reiterated the importance of partnerships between financial institutions and payment platforms. These collaborations enable the secure sharing of intelligence, ensuring compliance with data protection laws.
This, in turn, facilitates the detection of suspicious activities while maintaining privacy. He also highlighted the need to address delays in fraud tracking. To achieve this, he advocated for the deployment of real-time blacklisting mechanisms. This would enable swift action on reported incidents, preventing fraudsters from exploiting time gaps.
While highlighting the need for industry-wide collaboration, Banigbe pointed to the cost-effectiveness of shared investments in advanced security architecture. “No single organisation can tackle this alone. A united effort among telcos, financial institutions, and regulators is key to safeguarding our financial systems,” he asserted.
The panel discussion, which featured other notable speakers, including Ikenna Ndugbu (Moniepoint), Sheila Senfuma (Consumers International), and Modupe Ladipo (Prosperar Consulting), explored diverse aspects of combating digital payment fraud.
They discussed the role of robust compliance frameworks and transaction monitoring tools; addressed accessibility challenges for vulnerable populations, including people with disabilities like visual impairment that disallows them from baseline financial literacy; highlighted the specific vulnerabilities faced by women in informal financial systems and advocated for culturally sensitive financial inclusion strategies.
Banigbe further remarked on the need for proper access control within organisations to combat possible internal staff collusion with external fraudsters to make security systems more vulnerable.
“Regulating access will help prevent fraudulent activities within organisations,” he said, pointing to the need for stronger internal controls to safeguard sensitive processes.
He spotlighted the crucial role of telcos in creating a secure and inclusive digital financial ecosystem. Collaboration, Banigbe stressed, is essential to achieving lasting results in the fight against fraud.
“It is an ecosystem, and there should be a joint effort to enlighten the public on digital payment fraud and advocate for victims of fraud,” he concluded, calling for unified action among telcos, financial institutions, and regulators.
With over 100 participants attending the conference, the collective commitment to combat digital payment fraud is evident. Discussions continue to focus on leveraging technology, driving public awareness, and strengthening collaborative frameworks to address the pervasive threat of identity theft.
Telecom
Prof. Adewale Obadare Shares Key Insights on Breaking into Cybersecurity
Professor Adewale Obadare, a renowned cybersecurity expert and the first Professor of Practice in Cybersecurity in Nigeria, shared his valuable insights on how to break into the cybersecurity industry. With over 58 professional certifications and numerous awards, including the Outstanding Digital Trust Leader Award, Obadare’s expertise is unparalleled.
Speaking at FirstBank’s Cybersecurity Career Webinar that was held over the weekend, Prof. Obadare emphasized that cybersecurity is a field with numerous opportunities, including job security, competitive salaries, and global recognition.
However, he noted that many individuals struggle to break into the industry due to a lack of understanding of their strengths and weaknesses.
To succeed in cybersecurity, Obadare advised individuals to identify their cognitive strengths and choose a career path that aligns with their skills.
He emphasized that there are two primary paths in cybersecurity: technical and governance, risk, and compliance (GRC).
Obadare debunked the myth that certifications are unnecessary, stating that they provide a structured way of learning and are essential for building cognitive competence.
He defined cognitive competence as the acquisition of knowledge and theoretical understanding, which is synonymous with knowledge and mastery of concepts and theoretical knowledge.
Obadare shared a personal anecdote to illustrate the importance of cognitive competence. He recalled a situation where a colleague, who was practically skilled but lacked cognitive competence, deleted a critical system file (NTLDR) while backing up a critical system.
Obadare, who had acquired cognitive competence through certification, knew that deleting the file would prevent the system from booting up. He intervened, recovered the file, and restored the system.
He further emphasized that cognitive competence is essential for making informed decisions and taking effective actions in cybersecurity.
He encouraged individuals to acquire certifications, such as CompTIA Security+, to build their cognitive competence and provide a structured way of learning.
In addition to cognitive competence, Obadare highlighted the importance of functional competence, which is the ability to translate theoretical knowledge into practical skills.
He emphasized that individuals need to strike a balance between cognitive and functional competence to succeed in cybersecurity.
While advising prospective Nigerians seeking to take up career in cybersecurity, Obadare advised them to be humble, open-minded, and willing to learn from others.
According to him, “My advice to individuals seeking to break into cybersecurity is to acquire certifications to build cognitive competence. Cultivate behavioral competence by being humble, open-minded, and willing to learn from others. Continuously learn and self-improve, as cybersecurity education and career is a journey, not a destination”.
In conclusion, Obadare’s insights provided a valuable roadmap for individuals seeking to break into the cybersecurity industry. By acquiring certifications, developing practical skills, and cultivating a positive attitude, individuals can set themselves up for success in this rapidly evolving field.
- E-Financial3 days ago
EFCC Says Nigerian Banks are Notorious Conduits of Financial Crimes
- Telecom3 days ago
NASENI Retreat Focuses on Aligning Development Institutes’ Goals
- News3 days ago
TEDxPAU 2024: Exploring New Possibilities and Shaping Tomorrow
- Uncategorized3 days ago
NIMC Introduces Paid National ID Card Amid Low Revenue
- E-Business3 days ago
Data Commission, NAICOM Partner to Safeguard Data in Insurance Industry
- E-Financial3 days ago
N159m Up for Grabs in Fidelity Bank’s GAIM 6 Promo
- Telecom17 hours ago
NCC, CBN to Resolve Telecoms, Banks’ USSD Debt Issue
- Telecom17 hours ago
Prof. Adewale Obadare Shares Key Insights on Breaking into Cybersecurity