how it happened
- whoattackerSMS phishing, fake IT call
- the gapsynced authenticatorGoogle cloud sync of codes
- theninternal systems27 customer accounts
- the result~$15M crypto theftone customer
what everyone assumed
Multi-factor authentication is supposed to mean that a stolen password is not enough, and an authenticator app is the recommended way to get there. The reasonable belief is that the code in that app stays bound to the device in the person’s hand. What few teams had registered was that the app could now sync those codes to a cloud account in the background.
what happened
The voice on the call, posing as IT, walked the employee through what was needed and obtained a live MFA code, enough to step inside. Here the second assumption gave way: Google Authenticator’s cloud-sync feature meant that gaining the employee’s Google account also surfaced the synced authenticator codes for the internal services tied to it. One phished login had quietly become a key to many. The factor meant to stand apart from the password was now traveling alongside it.
step by step
- a caller posing as IT gets an MFA codeThe employee is walked through it.
- authenticator codes sync to the Google accountOne phished login unlocks many internal services.the assumption breaks here
- 27 customer accounts reachedAll in cryptocurrency.
- about 15 million dollars stolen from one customerFortress Trust.
how it surfaced
The intrusion reached the accounts of 27 customers, all of them in the cryptocurrency industry. The incident was linked to the theft of roughly 15 million dollars in cryptocurrency from one affected customer, Fortress Trust. The post-incident account named the cloud-sync feature as the reason a single compromise spread as far as it did.
Multi-factor authentication only holds if the second factor stays separate from the first, and a convenience setting that backs codes up to the cloud can erase that separation without anyone choosing it.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersOne handed-over code lets the attacker into the Google account and all the synced codes.what it costs youOne phone call turns into access to many internal systems and customer accounts.
- or it goes like thisit happenedReddit, 2023howA fake login page passes the password and code to the real site as they are typed.what leavesinternal documents, code and dashboardswho ends up with itthe attacker behind the page
- or it goes like thisit happenedUber, 2022howLogin prompts keep coming until a tired employee taps approve.what leavesadmin tools and company chatwho ends up with itan attacker who bought a contractor's password
sources
your turn
what you can do about it
this week
Check whether your authenticator app syncs codes to a personal cloud account, and whether a help-desk or IT call can talk someone through handing a code over.
Your team uses an authenticator app, and you may consider MFA a settled question. The assumption to retire is that turning the app on is the end of the decision rather than the start of it. The strongest MFA quietly weakens when the second factor can be backed up, or simply asked for, the way the first one is.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →