How Safe is 2FA and What Else Should You Be Doing to Secure Your Business?

In the last few years, one thing has been gaining major popularity in social media accounts, cryptocurrency wallets, and even your email accounts – business and personal alike; that is the use of 2FA (a.k.a. two-factor authentication). What is 2FA? It’s a secure SMS code that you get on a mobile device, email, or computer, then put into a website so you can log-in, and their servers know it’s you. However, in recent months, an unnamed hacker group has learned how to compromise 2FA systems, steal your codes, then log in as you into numerous sites and social media networks.

 

How Hackers Do It

 

The new hacking group ends up using numerous Windows, Android backdoor malware that allows them remote access and then logs into your social media accounts. They are also using things like password managers like KeePass to steal and store your passwords. If an attacker has backdoor access to your systems and your client software, they may even be able to see when you change your password. This unique method of using info stealing software has been used mainly to steal documents – but by using these codes, they can steal so much more pertinent information about their target user or business and do so completely undetected. That means that even work mobile phones aren’t safe!

 

They install these malware programs onto your devices and computers by sharing malicious content via apps that are disguised as other major or popular applications. Therefore, if you aren’t getting it directly from the developing company, you need to be careful (don’t download that “full version” of Photoshop from anyone other than Adobe, for example). By linking the desktop malware to the Android malware, they can literally receive 2FA codes when you get them, go to your account, and then log in to steal even more from you. It does this because it copies the SMS code you received so they can completely bypass your secondary authentication.

 

Is it In the United States?

Fortunately, the majority of the attacks that have been detected aren’t even here in the States yet. The software discovered to have this malware embedded into it is an app designed to help Swedish, Persian-speaking residents get their licenses to drive in the country. The downside to this, though, is that there isn’t any evidence as to whether these hackers are using other malicious apps to attack others outside of their homelands. This means that your business could be at risk (or your personal accounts even) if they use 2FA to log into your accounts.

 

So Is 2FA Really Safe?

 

It was thought that this form of authentication was the safest way to be online. Still, in the light of the “internet of things” and the fact that everyone’s accounts are connected and synchronized with other platforms, this can pose a potential risk when it comes to employees that aren’t able to be fully monitored with information – especially when they’re working remotely these days. Does this mean that remote workers themselves are at risk? Not necessarily. But this does mean that the employees you hired inside your company can have a higher chance of getting attacked, leading your systems to be compromised.

 

The Fix

 

The best way to fix this possible issue is to utilize a monitoring platform that can give you above and beyond service. This means that when an employee uses their mobile tablet or laptop, you can count on your systems monitoring the activity. You can also have your IT team take care of your systems so they are protected to help keep the hackers out and keep your precious data in.