Our sales staff can read their email and use the customer system from a personal computer, through the browser, with a second factor at sign in. Sessions on webmail and the customer system stayed valid for ninety days if you ticked keep me signed in, and almost everyone did.
In May one account manager's son installed a free modification for a game on the family computer. It carried information stealing malware, the kind that copies saved passwords and browser cookies and sells them in bundles. Among the cookies were her live sessions for our mail and our customer system.
Three weeks later someone loaded those cookies into a browser abroad. There was no sign in, so there was no second factor and no unusual sign in alert. The services simply saw a session they had already trusted. Over two evenings the intruder exported four thousand eight hundred customer contacts and replied, from her mailbox, inside existing conversations with about six hundred of them, attaching a document that asked for a sign in to view it. A reply inside a real thread from a real account manager is about as convincing as email gets.
A customer rang her on the Monday about the attachment. We revoked her sessions within the hour, reported the incident to the regulator and wrote to every contact in the export. Eleven customers had entered their credentials on the fake page, and we helped their IT teams through it.
Looking back, every control we had was aimed at the moment of signing in. Our logs, our alerts and our policy all treated a successful sign in with a second factor as the end of the question. But what an attacker wants is the session that follows, and that lives in a cookie on whatever computer created it, including one shared with a twelve year old.
Personal devices now get browser sessions of twelve hours, with no keep me signed in and no downloads or exports. Exports from the customer system need a managed laptop. A session that suddenly appears from a new country or network is revoked automatically, and we alert on that, not only on sign ins. We also told staff, plainly, what a family computer can carry.
A second factor checks who opens the door. The session is what holds it open afterwards, and it can be carried away.
– Serguey Shinder
Top comments (0)