We see those type of things.
Two-factor authentication or multi-factor authentication has
helped clean up a lot of those attacks,
but it does have to be implemented correctly.
It also needs to be two-channel, is what I call it,
where you're not getting your code to get in on the
same device that you sent the request.
Oh yeah.
Because I've seen where you get this multi-factor authentication,
so that's the username and a password, and now I need a separate code.
And the separate code's sent to the computer I'm logging in from.
So I then copy and paste, which is really easy,
but the bad guy's on this computer, yeah?
Yeah.
We saw a merchant that got breached.
They set up multi-factor authentication,
but they allowed their employees to have the option of sending the code,
the access code, to either their phone or to their email account.
Well if they checked the email account on the same
computer that the attacker has, the attacker has --- Has the code.
--- that code.
We've also seen a recent phenomenon with code replay
attacks where the attacker knows that two-factor or
multi-factor authentication is in place,
and so they'll wait for the legitimate employee to send a remote access request,
and then they'll send another one immediately right behind them.
And the person gets theirs and approves it, and then sees another one.
It's like, ah, I thought I approved that.
Click, and they do it again not realizing that that second one,
they didn't send it.
That was the attacker sending it.
And so that's kind a social engineering way that hackers are
getting passed even multi-factor authentication.
And that's the way attacks work, but we found defenses.
PCI DSS put a requirement for all remote access to
have multi-factor authentication, the last version,
and now the bad guys are trying to work out ways around that.
It's a cat-and-mouse game.
They're always adapting.
It's move, countermove.
Have you seen them doing SIM swapping for multi-factor authentication breaking,
because we've seen some of that in Europe now?
Not as much here, though we do see it from time to time.
So, while I'm going to through this, I'm trying to think in my head,
if I could sit in front, if we could sit in front,
in fact, we are sitting in front of lots of merchants today.
They're all watching us at different times.
The piece of advice I've got here is about secure your remote access.
This is the first lesson, yeah?
Yes.
Secure your remote access.
If you've got an ISO with a remote access,
convince yourself that they're doing it properly.
Not only convince, validate.
Okay, how would they do that?
They can get a third party that is skilled in that area or
they can have their IT do basic tests.
If you're doing multi-factor authentication,
test it and make sure that that code is going to the
person who it's supposed to go to.
So not taking the ISOs word, basically.
Yeah.
Okay, that's good.