Hello, welcome to the Tuesday, July 18th, 2017 edition of the Sands and at Storm Center's

Stormcast. My name is Johannes Ulrich, and today I am recording from Jacksonville, Florida.

Renato came across an interesting fishing attempt that actually involved two-factor

authentication. Two-factor authentication is usually the best defense against

fishing, but in this particular case, the bad guys actually tried to bypass two-factor authentication as

well. This attempt was directed against Brazilian users of a bank in Brazil that does hand to its customers

little cards with essentially one-time passwords that you can use. So it's really just a printed

set of numbers. Now what this particular fishing attempt did was they asked the user for their username and

password and then they asked them to just take a picture off that card with their camera

and send it and upload it via the fishing site.

I think this is pretty ingenious and I can see where victims will fall for something like this

because they don't quite understand the significance of actually taking a picture and sending

it in given that they still believe that they are connected to their bank.

Now this is also one problem of these printed one-time password cards.

They are quite cheap to produce, of course, and not all that inconvenient to use.

But the problem with these systems is that you don't really know if someone made a copy of the card and probably

many users will make copies of these cards in order to have like one at work, one at home,

and maybe keep one in their wallet. That's one advantage of going with real hard tokens that will only display one number at a time and

they actually have some protection against, for example, disassembling the token.

And Guido Francon is at it again with his fusing skills and this time he looked at the radius and DHCP parsers produced by the

Free Radius project. Radius is an authentication protocol used in many networking systems. Free

Radius is probably the most popular open source implementation of this protocol,

...