PoisonSeed outsmarts FIDO keys without touching them – Source: www.csoonline.com

PoisonSeed, the notorious crypto-hacking attack group known for large-scale phishing campaigns, was seen cracking Fast Identity Online (FIDO) protections in a novel social engineering technique.

In a campaign discovered by Expel, the infamous supply chain phishing attackers leveraged the cross-device sign-in feature available with FIDO keys.

FIDO keys use hardware-based multi-factor authentication to address vulnerabilities found in other MFA methods.

“If a user whose account is protected by a FIDO key enters their username and password into the phishing page, their credentials will be stolen, just as any other user,” Expel researchers in a blog post. “But with a FIDO protecting their account, the attackers are unable to physically interact with the second form of authentication.”

PoisonSeed attackers seem to have cracked this with a new trick. Instead of stealing or cloning a FIDO key, the attackers just convince users to scan a QR code, an exact copy of the QR prompted in a legitimate cross-device sign-in, that completes the malicious login for them.

“This is a fun attack, and one we all need to instrument for,” said Trey Ford, chief information security officer at Bugcrowd. “Yes, this is doable, and what we need to keep in mind is that every security control, on some level, will have failure modes.”

Cross-device convenience becomes the crosshair

The PoisonSeed technique is exploiting a little-understood feature of many identity platforms, QR-code-based cross-device sign-in. Attackers use a fake login page, often mimicking Okta or similar providers, that presents a QR prompt after a password entry. When the user scans this QR with a legitimate authenticator app, it completes the session, but for the attackers.

“Credentials were captured with a fake Okta page, which were then used to invoke the cross-device sign-in workflow that presents a QR code meant for legitimate secondary devices,” explained Jason Soroko, senior fellow at Sectigo. “The phishing site mirrored this code back to the user who scanned it with an authenticator app, which completed the FIDO challenge, even though the physical key never moved.”

This maneuver gave the adversary an active session while the key stayed safe in the victim’s pocket, which proves that social engineering remains the soft underbelly, he added.

Soroko has recommended turning off cross-device sign-in where possible and watching for unexpected device registrations or unusual geographies.

FIDO isn’t broken, just outsmarted

Expel researchers called the campaign a concerning development, given that FIDO keys are often regarded as one of the pinnacles of secure MFA. “While we haven’t uncovered a vulnerability in FIDO keys, IT and SecOps folks will want to sit up and take notice,” they said. “This attack demonstrates how a bad actor could run an end-route around an installed FIDO key.”

J Stephen Kowski, field CTO at SlashNext, offered a different solution. “Organizations should definitely take this seriously and consider implementing additional safeguards like requiring Bluetooth proximity between devices during cross-device authentication, while also ensuring their security solutions can detect and block these sophisticated phishing attempts before they reach users,” he said. For users who absolutely need to have FIDO cross-device sign-in turned on, Expel recommends properly checking if sign-in requests came from suspicious locations and looking for registration of unfamiliar, unexpected, or untrusted keys.