- Local time
- 2:05 AM
- Posts
- 83
- OS
- Microsoft Windows 11 Professional High End
Questions: What are the best practices using a VPN when using a shared Wi-Fi to avoid being hacked? More specifically, How can we guard against cybercriminals bypassing multifactor authentication by stealing cookies?
Background
We have a small group of individuals working on a large project. Most of us work from home or from our offices, and we are located in different locations in British Columbia and Alberta.
On Monday, two days ago, two colleagues were meeting in an office tower in downtown Calgary, Alberta. Colleague A has a permanent office located there, and colleague B was visiting. A uses a PC, and B uses a Mac. For a portion of their in-person meeting, all of us in our group were meeting through Microsoft Teams. In other words, most of us were virtual and while A and B were located together in a conference room. B was using Wi-Fi to connect to the internet.
All of us have Microsoft 365, and we have enforced two-factor authentication.
As B was leaving the conference room and heading toward the elevator just before noon, he started receiving emails and texts about a suspicious email that people were receiving. Many of us, including me, got an email with “RFP Review Required from XYZ Organization” where XYZ Organization was our organization. For the work we are doing, requests for proposals are common.
When I clicked on the link to access the “encrypted document,” I got directed to a website where Norton 360 complained that it was not safe. I shut my browser tab and thought I would ask B to put the document on our server so that we could access it without having to click on links. Shortly thereafter, I learned that the email was malicious because B did not send the document and many were receiving it.
Once we knew we had a problem, we froze his account and signed him (hacker) out of any active sessions. Later, we spoke with B and provided him with a new password and unfroze his account.
When we checked B’s recent accesses to his Microsoft account, we saw accesses from California at around the time the emails went out. I then ran a mail trace to see who the hacker had emailed. The hacker emailed 265 people within one minute.
I am guessing that a hacker got stole session cookie to B’s Microsoft 365 account. With that cookie, he did not need the password or the two-factor authentication. He was then able to send emails to others using B’s account and his organization.
So I am wanting to know how to guard against this problem. If I am using a pc laptop with a VPN, I first need to connect to the internet before engaging the VPN. Is that correct? How can I ensure that hacker cannot get access to anything on my PC?
I know that once I am on the internet with my VPN engaged, I am safe. My main concern is the time between accessing the internet and engaging my VPN.
Are there any best practices to follow?
For those interested, here’s a link from the FBI on “Cybercriminals Are Stealing Cookies to Bypass Multifactor Authentication”:
www.fbi.gov
Perhaps this post belongs in "AntiVirus, Firewalls and System Security"? If so, can someone please move it. Thank you.
Background
We have a small group of individuals working on a large project. Most of us work from home or from our offices, and we are located in different locations in British Columbia and Alberta.
On Monday, two days ago, two colleagues were meeting in an office tower in downtown Calgary, Alberta. Colleague A has a permanent office located there, and colleague B was visiting. A uses a PC, and B uses a Mac. For a portion of their in-person meeting, all of us in our group were meeting through Microsoft Teams. In other words, most of us were virtual and while A and B were located together in a conference room. B was using Wi-Fi to connect to the internet.
All of us have Microsoft 365, and we have enforced two-factor authentication.
As B was leaving the conference room and heading toward the elevator just before noon, he started receiving emails and texts about a suspicious email that people were receiving. Many of us, including me, got an email with “RFP Review Required from XYZ Organization” where XYZ Organization was our organization. For the work we are doing, requests for proposals are common.
When I clicked on the link to access the “encrypted document,” I got directed to a website where Norton 360 complained that it was not safe. I shut my browser tab and thought I would ask B to put the document on our server so that we could access it without having to click on links. Shortly thereafter, I learned that the email was malicious because B did not send the document and many were receiving it.
Once we knew we had a problem, we froze his account and signed him (hacker) out of any active sessions. Later, we spoke with B and provided him with a new password and unfroze his account.
When we checked B’s recent accesses to his Microsoft account, we saw accesses from California at around the time the emails went out. I then ran a mail trace to see who the hacker had emailed. The hacker emailed 265 people within one minute.
I am guessing that a hacker got stole session cookie to B’s Microsoft 365 account. With that cookie, he did not need the password or the two-factor authentication. He was then able to send emails to others using B’s account and his organization.
So I am wanting to know how to guard against this problem. If I am using a pc laptop with a VPN, I first need to connect to the internet before engaging the VPN. Is that correct? How can I ensure that hacker cannot get access to anything on my PC?
I know that once I am on the internet with my VPN engaged, I am safe. My main concern is the time between accessing the internet and engaging my VPN.
Are there any best practices to follow?
For those interested, here’s a link from the FBI on “Cybercriminals Are Stealing Cookies to Bypass Multifactor Authentication”:
Cybercriminals Are Stealing Cookies to Bypass Multifactor Authentication | Federal Bureau of Investigation
The FBI Atlanta Division is warning the public that cybercriminals are gaining access to email accounts by stealing cookies from a victim’s computer.
www.fbi.gov
Perhaps this post belongs in "AntiVirus, Firewalls and System Security"? If so, can someone please move it. Thank you.
Last edited:
My Computer
System One
-
- OS
- Microsoft Windows 11 Professional High End
- Computer type
- PC/Desktop
- Manufacturer/Model
- Boxx Technologies
- CPU
- 13th Gen Intel(R) Core(TM) i9-13900K 3.00 GHz
