A look at the booming market for bots that steal 2FA codes, often using SMS services like Twilio, to break into Coinbase, Amazon, PayPal, and bank accounts
The bots convincingly and effortlessly help hackers break into Coinbase, Amazon, PayPal, and bank accounts. — Joseph Cox Tweets: @josephfcox , @motherboard , @rzol , @josephfcox , @josephfcox , @josephfcox , @motherboard , @josephfcox , @josephfcox , @josephfcox , @josephfcox , @josephfcox , @spencerdailey , @racheltobac , @timmarchman , and @jason_koebler Tweets: Joseph Cox / @josephfcox : These bots are not just for SMS-based 2FA. Can work for app-based too such as Google Authenticator. Seen bots that target Amazon, PayPal, Apple Pay, Venmo, Bank of America, Chase, etc https://www.vice.com/... https://twitter.com/... @motherboard : With bots that cost only a few hundred dollars, anyone can start getting around multi-factor authentication, a security measure that many members of the public may assume is largely secure. https://www.vice.com/... Rita Z / @rzol : Great reporting! This is among the most realistic phone scams I've heard to trick people into giving up credentials and 2FA codes. Innovating on MFA (and getting rid of pwds in the long run) is key. #infosec #2Fac https://twitter.com/... Joseph Cox / @josephfcox : “The bot is great for people who don't have social engineering skills,” one OTP bot seller said. Not everyone is “comfortable and persuasive on the phone you see.” https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : The ecosystem of these OTP bots is already pretty varied. Contacted one in around August, it went dark response, but now points to another similar bot. https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : The calls from the bot are persuasive. Someone is trying to use your PayPal account, please verify you didn't send that money. Enter the code we just texted you (at same time, hacker triggers a legit 2FA code from PayPal). Sense of urgency likely effective https://www.vice.com/... https://twitter.com/... @motherboard : The bots convincingly and effortlessly help hackers break into Coinbase, Amazon, PayPal, and bank accounts. https://www.vice.com/... Joseph Cox / @josephfcox : The bots are super simple to use. Enter the target's number, and the platform you're trying to break into. Bot handles the rest and then gives you the code too. Here's what it looks like https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : Contacted a wealth of orgs targeted by the bots (Amazon, Apple, PayPal, Bank of America, Chase, Coinbase) and asked if they support hardware security keys. Only one said they did, Coinbase. As piece says, raises Qs on whether platforms need to do more https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : As for how they work, the bots use either Telegram or Discord. On the backend are sites like Twilio, which can send automated messages and calls. Twilio confirmed it is seeing OTP bots on its platform and taking them down https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : Piece includes video of one of the bots in action. Very easy for anyone to use, now essentially any level of skill fraudster can try to bypass 2FA. Raises Qs on whether services need to do more than SMS/app 2FA https://www.vice.com/... https://twitter.com/... Joseph Cox / @josephfcox : New: underground trade of bots that steal your 2FA codes. Bot places convincing automated call to target. Victim enters code, gets fed to hacker instantly. Dramatically lowers the barrier of entry for bypassing 2FA, no social engineering skills needed https://www.vice.com/... Spencer Dailey / @spencerdailey : stop it Paypal, you're drunk. (How does a service that deals with money not think it's a terrible idea to let users log in with just SMS?) https://twitter.com/... Rachel Tobac / @racheltobac : Scammers don't need social engineering skills to steal OTP / 2FA codes — a scam bot can do it for them. How to protect? 1. Orgs need to give users option for FIDO security keys 2. Educate on this scam method 3. Help others use FIDO keys if a match for them https://www.vice.com/... https://twitter.com/... Tim Marchman / @timmarchman : Fraudsters are using inexpensive robots to trick people into handing over their 2FA codes: https://www.vice.com/... Jason Koebler / @jason_koebler : Automated voice theft of two factor codes under the guise of fraud prevention is a new, horrifying attack vector for users of SMS 2FA https://www.vice.com/...