Is MFA Not Enough

https://smartermsp.com/when-mfa-isnt-enough-the-session-hijacking-problem/?

I read a post today on @SmarterMSP that points out the growing dangers of session hijacking.

Session hijacking involves a bad actor stealing your authenticated session code from your browser and using it to access your data. Since my audience is generally not composed of IT professionals, let me break that down a bit.

When you sign into a service, your browser stores information that keeps you logged in. That’s why you don’t have to continually re-type your password every time you open a tab. Some of these session codes last for days. If someone steals them, they instantly gain access to whatever account that code connects to.

Crucially, this completely bypasses the need for your username, password, or even your multi-factor authentication (MFA) code—the 6-digit number sent to your text, email, or found in an authenticator app. Because the hacker stole a session that is already logged in, the security gates are already open.

Here are a few practical things to consider to protect yourself:

• Keep security software active. Most ways hackers steal your session codes involve putting malware on your computer. Make sure your antivirus and security software are active and up to date.
• Beware of login traps (Social Engineering). Hackers frequently use fake websites that look exactly like your bank, email, or corporate login page. If you log into one of these fake sites, you are handing your active session straight to the attacker.
• Watch where you click. Always verify the website address you are visiting. It is best to type the URL into your browser yourself rather than clicking a link from an unexpected email, text, or even a random search engine result.

If you work in IT or want a deeper look at the technical details, check out the linked post. I have always found that SmarterMSP provides excellent, accurate data, even though their content is aimed at service providers and is a bit more technical.