What you need to know
- Dutch research firm ThreatFabric has discovered malware that can steal two-factor authentication codes from Google Authenticator.
- Cerberus is the name of the banking trojan, but the strain that can steal 2FA codes is currently in testing and not yet available.
- In general, it is more secure to use an app to generate 2FA codes such as Google Authenticator instead of using SMS.
Two-factor authentication or 2FA is a commonly used system to help protect your online accounts. It requires a user to enter an additional code when logging in, which is usually sent through SMS or generated with an app. In general, it is best to use an app to generate the code, such as Google Authenticator, instead of allowing it to be sent over the network to your phone where you run the risk of it being intercepted.
Unfortunately, security researchers from ThreatFabric recently discovered a strain of the Cerberus banking trojan, which can steal 2FA codes from Google Authenticator.
Abusing the Accessibility privileges, the Trojan can now also steal 2FA codes from Google Authenticator application.
When the [Authenticator] app is running, the Trojan can get the content of the interface and can send it to the [command-and-control] server.
In the report, the Dutch mobile security firm said, "We believe that this variant of Cerberus is still in the test phase but might be released soon."
While Cerberus is primarily a banking trojan, the researches note that it now includes many features found in traditional remote access trojans. This would allow users with Cerberus to remotely access your phone and access your bank account, including stealing the 2FA code if needed. It would also allow the attacker to access any other accounts you have enabled two-factor authentication on, such as your email, social media, shopping sites, and more.
Fortunately, for the time being, the Cerberus variant with 2FA stealing capabilities appears to still be in testing, and not out in the wild. Hopefully, by the time it has launched, Google will have found a way to prevent it from accessing two-factor authentication codes.
Microsoft is reportedly considering buying the WB Games division
Microsoft is reportedly considering a bid on Warner Bros. Interactive Entertainment. Previously, Take-Two Interactive, Electronic Arts and Activision were all reportedly interested as well.
Everything we know (so far) about the Google Pixel 5
We're still months out from Google unveiling the Pixel 5, but that doesn't mean it's too early to speculate what it might offer. Here's everything we know so far!
The Sonos One is excellent in 2020 — here are 5 reasons to still buy it
The Sonos One is almost three years old, but even so, it remains as one of the best smart speakers you can buy. Here are five reasons why it's still so darn good!
Believe it or not, Philips Hue is far from the only smart bulb you can buy
The are plenty of smart lights available that are similar to Philips Hue bulbs at nearly half the cost. Most offer easy management from a designated app on your smartphone or tablet, too.