Forest Global Training Partners

Cyber Risks · Cisco Talos

What might authentication attacks look like in a phishing-resistant future?

Summary: Cisco Talos researchers Thorsten Rosendahl and Tiago Pereira argue that as passwordless authentication and FIDO2 passkeys spread, attackers will shift from stealing passwords to stealing post-authentication session IDs and targeting the weaker registration, recovery, and revocation processes. They name specific likely vectors: phishing cloud providers and password managers for recovery fallbacks, phishing email providers for magic-link passkey re-registration, and session theft via bookmarklets, clipboard pastejacking, and browser-based malware.

Bottom line: FIDO2 does not change how application sessions work, so on a compromised device an attacker can still steal the session ID after authentication and pose as the user - meaning the credential theft you have spent years defending against may simply migrate to a session token your controls were never built to protect.

Read the original at Cisco Talos ↗

Topics
Identity & Access Management
Related