Telecom
Attackers Exploit Stolen Session Cookies to Bypass Multi Factor Authentication and Gain Access to Corporate Resources – Sophos Report Reveals
Sophos, a global leader in next-generation cybersecurity, today announced in the Sophos X-Ops report, “Cookie stealing: the new perimeter bypass,” that active adversaries are increasingly exploiting stolen session cookies to bypass Multi-Factor Authentication (MFA) and gain access to corporate resources.
In some cases, the cookie theft itself is a highly targeted attack, with adversaries scraping cookie data from compromised systems within a network and using legitimate executable to disguise the malicious activity.
Once the attackers obtain access to corporate web-based and cloud resources using the cookies, they can use them for further exploitation such as business email compromise, social engineering to gain additional system access, and even modification of data or source code repositories.
“Over the past year, we’ve seen attackers increasingly turn to cookie theft to work around the growing adoption of MFA. Attackers are turning to new and improved versions of information stealing malware like Raccoon Stealer to simplify the process of obtaining authentication cookies, also known as access tokens,” said Sean Gallagher, principal threat researcher, Sophos. “If attackers have session cookies, they can move freely around a network, impersonating legitimate users.”
Session, or authentication, cookies are a particular type of cookie stored by a web browser when a user logs into web resources. If attackers obtain them, then they can conduct a “pass-the-cookie” attack whereby they inject the access token into a new web session, tricking the browser into believing it is the authenticated user and nullifying the need for authentication.
Since a token is also created and stored on a web browser when using MFA, this same attack can be used to bypass this additional layer of authentication.
Compounding the issue is that many legitimate web-based applications have long-lasting cookies that rarely or never expire; other cookies only expire if the user specifically logs out of the service.
Thanks to the malware-as-a-service industry, it’s getting easier for entry-level attackers to get involved in credential theft. For example, all they need to do is buy a copy of an information-stealing Trojan like Raccoon Stealer to collect data like passwords and cookies in bulk and then sell them on criminal marketplaces, including Genesis.
Other criminals on the attack chain, such as ransomware operators, can then buy this data and sift through it to leverage anything they deem useful for their attacks.
Conversely, in two of the recent incidents that Sophos investigated, attackers took a more targeted approach. In one case, the attackers spent months inside a target’s network gathering cookies from the Microsoft Edge browser.
The initial compromise occurred via an exploit kit, and then the attackers used a combination of Cobalt Strike and Meterpreter activity to abuse a legitimate compiler tool to scrape access tokens. In another case, the attackers used a legitimate Microsoft Visual Studio component to drop a malicious payload that scraped cookie files for a week.
“While historically we’ve seen bulk cookie theft, attackers are now taking a targeted and precise approach to cookie stealing. Because so much of the workplace has become web-based, there really is no end to the types of malicious activity attackers can carry out with stolen session cookies. They can tamper with cloud infrastructures, compromise business email, and convince other employees to download malware or even rewrite code for products. The only limitation is their own creativity,” said Gallagher.
“Complicating matters is that there is no easy fix. For example, services can shorten the lifespan of cookies, but that means users must re-authenticate more often, and, as attackers turn to legitimate applications to scrape cookies, companies need to combine malware detection with behavioral analysis.”
To learn more about session cookie theft and how adversaries are exploiting the technique to carry out malicious activity, read the full report, “Cookie Stealing: the new perimeter bypass,” on Sophos.com.
French antitrust regulators have fined Apple 150 million euros ($162 million) over its App Tracking Transparency (ATT) feature, which is facing scrutiny in multiple European countries.
The French Competition Authority ruled that Apple’s implementation of ATT was “neither necessary nor proportionate to the company’s stated goal to protect user data” and unfairly penalized third-party publishers.
Alongside the financial penalty, Apple has been ordered to publish the decision on its website for seven days. The ruling comes amid ongoing investigations in Germany, Italy, Romania, and Poland into ATT, which Apple introduced in 2021 as a privacy safeguard.
ATT requires apps to obtain explicit user consent via a pop-up before tracking activity across other apps and websites. If users decline, the app loses access to their advertising identifier, limiting targeted advertising. Critics argue that the system disproportionately benefits Apple by restricting competitors while promoting its own advertising services.
The French watchdog found that ATT forces users to navigate excessive consent windows for third-party apps on iPhones and iPads, making the process unnecessarily complicated.
Additionally, Apple’s system requires users to opt out of ad tracking twice rather than once, which the authority said undermines the feature’s neutrality and causes economic harm to app publishers and ad service providers.
The ruling emphasized that smaller publishers, which rely heavily on third-party data collection for revenue, are particularly affected.
The French regulator initially declined to impose emergency measures in 2021 after complaints from the advertising industry, but continued its investigation, ultimately leading to Monday’s decision.
Pan-African technology company Cassava Technologies, in a strategic collaboration with Microsoft, has launched a community engagement initiative focused on South Africa.
Through this initiative, the two organisations will establish training hubs for youth in the local communities that will help spur employment opportunities in the renewable energy industry.
By prioritising renewable energy skills development, energy efficiency, and community microgrids, the initiative will empower the next generation to lead in the transition to clean energy. Activities will be focused in Johannesburg and Cape Town, where Cassava and Microsoft operate.
The project’s training hubs will play a vital role in equipping Africa’s women and youth with the skills they need to thrive in the renewable energy industry and ensure that the benefits of the energy transition are realised by all.
Cassava Technologies, through its renewable energy company and co-location companies, will be a key player in this collaboration. Their local renewable energy expertise will ensure that the initiative delivers tangible benefits linked to clean energy jobs and projects to the communities that are involved.
Through this initiative, Cassava and Microsoft are supporting community engagement and sustainable development in the region and across the continent, which lays the groundwork for expansion into other African markets.
Finhai Munzara, Chief Corporate Development Officer of Cassava Technologies, said, “We are honoured to collaborate with Microsoft on this project, which ensures that we bring all Africans along as we transition to a digitally connected future using sustainable energy. By leveraging our technological expertise, on-the-ground experience, and Microsoft’s global reach, we are poised to make a lasting, positive impact on South African communities.”
“We are pleased to work with Cassava to support climate initiatives in South Africa that enhance local communities, ensuring that those all have the tools to thrive,” said Markus Swart, Director of Data Centre Operations in South Africa at Microsoft.
MTN South Africa, in partnership with Lynk Global, has successfully conducted Africa’s first satellite-to-mobile phone call touted as a groundbreaking development.
This historic trial, conducted in Vryburg, North West province, marks a major step toward bridging connectivity gaps in underserved and rural regions across the continent.
The test involved making a voice call using a standard smartphone connected via a low-Earth orbit (LEO) satellite.
This innovative approach eliminates the need for traditional network infrastructure, providing a viable solution for remote areas with limited or no mobile coverage.
According to Charles Molapisi, CEO of MTN South Africa, this initiative aligns with the company’s broader strategy to extend network coverage to hard-to-reach areas.
“This achievement demonstrates our commitment to leveraging cutting-edge technology to ensure connectivity for all, regardless of location,” Molapisi stated.
The trial also assessed SMS capabilities over the LEO satellite connection, proving the technology’s potential for widespread application.
With successful implementation, satellite-to-mobile communication could revolutionise telecommunications in Africa, enabling digital inclusion and economic opportunities in regions previously disconnected from mainstream networks.
This milestone underscores the growing role of satellite technology in Africa’s telecommunications landscape.
By integrating satellite solutions with existing mobile networks, MTN and Lynk Global aim to provide seamless connectivity that overcomes traditional infrastructure challenges.
Questions Over House of Reps Threat to Arrest NIMC DG
FundQuest Empowers Women Entrepreneurs, Fueling Economic Growth
1st of April Joke or a Cyberattack, Tips to Avoid Both
Apple Faces €150M Fine in France Over Alleged Antitrust Violations
Cassava and Microsoft Boost Youth Employment in Green Tech
Telecom1 day agoMTN, Lynk Global Make Africa’s First Satellite-to-Mobile Call
General News1 day agoSERAP Asks National Assembly to Drop Bill to Jail Nigerians who Fail to Vote
Telecom1 day agoSmart Treasure Investment Team’s Initiatives Eradicate Poverty, Says Aminu
E-Business1 day agoSystemSpecs’s Subsidiary Deelaa Becomes Whatadeal
E-Financial1 day agoNigeria Gets Fresh $500m World Bank Loan for Economic Stimulus Programme
E-Business1 day agoCybersecurity Firm Says It’s Time to Back it Up, As the World Marks World Backup Day
E-Financial1 day agoUninsured Depositors of Heritage Bank to Receive Liquidation Dividends In April – NDIC
General News1 day agoFG to Elevate Enugu Tech Festival to National Event – Minister